tiktok-search
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
python3 -cto parse and extract authentication tokens from a local JSON configuration file. It also utilizescurlto perform POST requests to the TikTok search endpoints. - [DATA_EXPOSURE]: Accesses the sensitive file path
~/.gooseworks/credentials.jsonto retrieve theapi_key. This file path is consistent with the skill author's infrastructure (gooseworks-ai). - [EXTERNAL_DOWNLOADS]: Instructs users to run
npx gooseworks loginif credentials are missing, which fetches and executes the vendor's authentication package. - [DATA_INGESTION_SURFACE]: The skill ingests untrusted data from TikTok (profiles, hashtags, video descriptions) via the Scrape Creators API.
- Ingestion points: API responses processed in
SKILL.md. - Boundary markers: None identified.
- Capability inventory: Limited to network read operations (
curl). - Sanitization: No explicit sanitization of the external content is described before being presented to the agent.
Audit Metadata