ecommerce-tiktok-video-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python scripts (
scripts/video_rank.pyandscripts/video_detail.py) to manage API requests, process responses, and handle local data caching.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a conduit for data from an external API (Kalodata), which presents a potential surface for indirect prompt injection attacks.\n - Ingestion points: External data, including video titles and creator handles, is fetched from the Kalodata API via a proxy defined by the
NEXSCOPE_PROXY_BASEenvironment variable.\n - Boundary markers: The scripts output JSON data or summaries directly to the agent's context without employing clear delimiters or instructions to ignore potential instructions embedded in the external content.\n
- Capability inventory: The skill possesses capabilities for network access (via
urllib) and filesystem modification (writing data to the current project directory or home directory).\n - Sanitization: The provided scripts do not perform validation or sanitization on text fields returned by the remote API before presenting them to the agent.\n- [EXTERNAL_DOWNLOADS]: Fetches TikTok promotional and engagement analytics from the vendor's proxy service as part of its core functionality.
Audit Metadata