linkfox-kalodata-tiktok-livestream
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes external data such as TikTok livestream titles and creator handles retrieved via API, which constitutes a potential surface for indirect prompt injection. This behavior is expected for a data retrieval tool and is well-scoped.
- Ingestion points: Livestream data returned from the Kalodata API endpoints in
scripts/kalodata_livestream_search.pyandscripts/kalodata_livestream_detail.py. - Boundary markers: No explicit delimiters or instructions are present to differentiate external data from agent commands.
- Capability inventory: The skill can write data to local project files and perform authenticated POST requests to the vendor's API gateway.
- Sanitization: External content is currently presented without explicit filtering or sanitization.
- [EXTERNAL_DOWNLOADS]: The
scripts/onboarding.pyscript references standard Python packages (requests,qrcode,pillow) as optional dependencies for its login and QR code generation features. These are well-known libraries and do not represent a security risk.
Audit Metadata