The Agent Skills Directory

[COMMAND_EXECUTION]: The testing framework in tests/test_tiktok_task.py utilizes subprocess.run to execute the skill's wrapper script. This is a standard practice for integration testing to ensure the script responds correctly to various API states and does not indicate a vulnerability in the primary skill logic.- [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of TikTok profile URLs and JSON input files.
Ingestion points: The url field and JSON input files are processed by scripts/tiktok_task.py via load_inputs.
Boundary markers: The prompt in agents/openai.yaml is direct; however, the script treats user inputs as structured parameters for API calls rather than instructions.
Capability inventory: The script performs authenticated network requests to the Frevana API and writes result files to the local ./out/ directory.
Sanitization: The function validate_tiktok_url in scripts/tiktok_task.py strictly validates that provided URLs are legitimate TikTok profile links using regular expressions and domain checks, preventing the tool from being used for generic SSRF.- [SAFE]: Authentication tokens are handled securely using environment variables or the getpass module for interactive entry, which ensures that sensitive FREVANA_TOKEN values are not logged or visible in the process environment.

tiktok-profiles-collect-by-url