linkfox-echotik-batch-video-detail
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill communicates with vendor-controlled API endpoints for data retrieval and account management.
- Endpoints include:
tool-gateway.linkfox.com,api.linkfox.com,agent-api.linkfox.com, andskill-api.linkfox.com. - [COMMAND_EXECUTION]: The skill utilizes Python scripts (
scripts/echotik_batch_video_detail.pyandscripts/onboarding.py) to execute its core functionality, handle API interactions, and manage user sessions. - [PROMPT_INJECTION]: The skill processes external data from TikTok which could potentially contain adversarial instructions (Indirect Prompt Injection).
- Ingestion points: TikTok video descriptions (
videoDesc), product categories (productCategoryList), and video product data (videoProducts) fetched from the EchoTik API. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present when processing the external video descriptions.
- Capability inventory: The skill has the ability to write to the local filesystem (under the
linkfox/directory for caching and data storage) and perform network requests to vendor APIs. - Sanitization: The provided scripts do not perform explicit sanitization or filtering of the video description strings before they are returned to the agent context.
Audit Metadata