ecommerce-tiktok-new-product-rank
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of a Python script (
scripts/echotik_list_new_product_rank.py) to interface with the product research API. This script performs network operations and manages a local cache and data store within anexscope/directory in the current workspace. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external TikTok Shop listings, which are controlled by third-party sellers and could theoretically contain malicious instructions.
- Ingestion points: Product titles, descriptions, and other metadata are fetched via the EchoTik API in the
echotik_list_new_product_rank.pyscript. - Boundary markers: The skill does not implement specific delimiters or instructions to treat the external API data as untrusted or separate from the agent's primary instructions.
- Capability inventory: The associated script has capabilities for network communication and local file-system writes.
- Sanitization: The script does not perform sanitization, filtering, or validation on the content returned by the external API before presenting it to the agent.
Audit Metadata