ecommerce-tiktok-creator-search-api

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a package-local Python script (scripts/kalodata_creator_search.py) to interface with the research tool gateway. This is the primary intended functionality of the skill and does not involve arbitrary command execution.- [DATA_EXFILTRATION]: The skill accesses the NEXSCOPE_API_KEY environment variable to authenticate with the vendor-controlled proxy gateway (NEXSCOPE_PROXY_BASE). Authentication is handled using standard Bearer token headers, and the skill includes explicit instructions to prevent secrets from being persisted in logs or user-facing outputs. Communication is restricted to the vendor's own infrastructure.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external TikTok rankings search results, which constitutes an attack surface for indirect prompt injection.
  • Ingestion points: External API data is ingested and processed by the kalodata_creator_search.py script.
  • Boundary markers: The skill does not use explicit delimiters for the external data, but it enforces display rules that require the agent to separate retrieved facts from calculations and to redact sensitive fields.
  • Capability inventory: The script performs network operations via urllib and writes cache/session data to the local file system.
  • Sanitization: The skill utilizes structured JSON parsing and defines strict rules for summarizing and redacting the returned payloads to minimize risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:13 AM