linkfox-kalodata-tiktok-livestream
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill integrates with Kalodata's TikTok data service using vendor-owned domains (linkfox.com, tool-gateway.linkfox.com, agent-api.linkfox.com). All network communications are directed to the vendor's gateway and API services for search, details, and account management.
- [DATA_EXPOSURE]: The scripts correctly handle authentication by reading API keys from environment variables (
LINKFOX_AGENT_API_KEY). No hardcoded secrets were found in the codebase. The script uses a configuration identifier for the login process, which is not a sensitive credential. - [COMMAND_EXECUTION]: The skill uses Python scripts to perform API calls. These scripts operate on local data and do not execute arbitrary shell commands or untrusted external code. The onboarding script provides instructions for the user to set environment variables manually, which is a standard configuration practice.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests livestream titles and creator handles from external TikTok data. While this represents a potential injection surface, the skill implements no high-risk capabilities that would allow such data to compromise the system, and the risk is assessed as minimal within the intended e-commerce analytics use case.
Audit Metadata