linkfox-kalodata-tiktok-video
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches external data from TikTok via the Kalodata API, including video titles and captions which are user-generated content from an untrusted source.
- Ingestion Point:
scripts/kalodata_video_search.pyandscripts/kalodata_video_detail.pyreceive API responses containingvideo_titledata and save them to JSON files in the workspace. - Boundary Markers: Absent. There are no explicit boundaries or delimiters surrounding the untrusted data fields when displayed to the agent.
- Capability Inventory: The skill can write JSON files to the local workspace and execute HTTPS requests to official gateway endpoints; it does not execute system commands or evaluate arbitrary code.
- Sanitization: Absent. The video titles and descriptions are processed and returned as raw strings without escaping or filtering.
Audit Metadata