The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/api_searcher.py uses the pickle.load() function to deserialize a local cache file (.openapi_cache.pkl). Since this file is located within the skill's own directory, a malicious author could include a crafted, malicious pickle file in the skill package. When the agent runs the searcher script, the malicious code would execute with the same privileges as the agent, leading to a complete system compromise.
[COMMAND_EXECUTION]: The scripts/api_client.py utility executes the curl binary using subprocess.run(). This is used to bypass TLS fingerprinting security measures on social media platforms. While the command is executed with a list of arguments rather than a raw shell string, the URL and parameters are constructed from inputs that could potentially be manipulated to perform unintended network operations or argument injection.
[PRIVILEGE_ESCALATION]: The logging mechanism in scripts/api_client.py attempts to locate and write to a SQLite database file named exachat.db by searching parent directories outside of the immediate skill workspace. This behavior suggests an attempt to access or modify the underlying platform's internal databases, which could lead to session hijacking or unauthorized modification of system logs.
[DATA_EXFILTRATION]: The skill is designed to send user-provided search queries and social media identifiers to external vendor APIs (api.tikhub.io and api.tikhub.dev). Users should be aware that their interactions and the resulting social media data flow through these external, third-party services.
[INDIRECT_PROMPT_INJECTION]: The skill ingests large volumes of untrusted data from social media platforms (comments, descriptions, user profiles) and provides it to the agent. This represents a significant surface for indirect prompt injection, as malicious instructions hidden in social media content could influence the agent's behavior once processed.
Ingestion points: scripts/api_client.py retrieves JSON data from TikHub APIs.
Boundary markers: The provided scripts do not implement any delimiters or sanitization logic to separate retrieved content from the agent's system instructions.
Capability inventory: The skill possesses file read/write access (via sqlite3) and the ability to execute network commands (curl).
Sanitization: No specific sanitization or filtering of API responses is performed before the data is returned to the agent's context.

tikhub-api-helper