linkfox-chuhaijiang-tiktok-creator
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses established environment variables (LINKFOX_AGENT_API_KEY) for authentication, avoiding hardcoded secrets in the implementation scripts.\n- [SAFE]: All network requests are directed to official vendor domains (tool-gateway.linkfox.com, api.linkfox.com, agent-api.linkfox.com) for data retrieval and account management.\n- [SAFE]: The onboarding process provides a legitimate mechanism for users to manage their platform access and credits, with sensitive data like phone numbers being masked in console output.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external TikTok creator data, including nicknames and signatures, which could theoretically contain malicious instructions designed to influence the agent's behavior.\n
- Ingestion points: Data is ingested through multiple API endpoints (e.g., /chuhaijiang/creators/search, /chuhaijiang/creators/detail) and processed by scripts such as chuhaijiang_creator_search.py.\n
- Boundary markers: The skill returns raw structured JSON data to the agent without explicit delimiters or warnings to ignore embedded instructions.\n
- Capability inventory: The skill has the capability to write files to the local ./linkfox/ directory and perform network requests to LinkFox API endpoints.\n
- Sanitization: There is no evidence of specific text sanitization or filtering for potential prompt injection patterns in the ingested creator profile fields.
Audit Metadata