tiktok-search

Pass

Audited by Gen Agent Trust Hub on Jun 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses python3 -c to parse and extract authentication tokens from a local JSON configuration file. It also utilizes curl to perform POST requests to the TikTok search endpoints.
  • [DATA_EXPOSURE]: Accesses the sensitive file path ~/.gooseworks/credentials.json to retrieve the api_key. This file path is consistent with the skill author's infrastructure (gooseworks-ai).
  • [EXTERNAL_DOWNLOADS]: Instructs users to run npx gooseworks login if credentials are missing, which fetches and executes the vendor's authentication package.
  • [DATA_INGESTION_SURFACE]: The skill ingests untrusted data from TikTok (profiles, hashtags, video descriptions) via the Scrape Creators API.
  • Ingestion points: API responses processed in SKILL.md.
  • Boundary markers: None identified.
  • Capability inventory: Limited to network read operations (curl).
  • Sanitization: No explicit sanitization of the external content is described before being presented to the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 23, 2026, 02:14 PM
Security Audit — agent-trust-hub — tiktok-search