skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-tiktok-video-download-url/Gen Agent Trust Hub
ecommerce-tiktok-video-download-url
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external TikTok URLs and displays data from the EchoTik API response, which creates a surface for indirect prompt injection attacks.
- Ingestion points: Data enters the agent's context via the user-provided
urlparameter and the resulting API response fields, such aserrmsgor video metadata. - Boundary markers: The instructions do not provide explicit delimiters or guidance for the agent to ignore instructions that might be embedded in the retrieved video content or API responses.
- Capability inventory: The skill includes scripts capable of performing network requests (
urllib.request) and writing JSON data to the local file system (os,open). - Sanitization: There is no evidence of filtering or sanitizing the strings returned from the external API before they are processed by the agent.
- [COMMAND_EXECUTION]: The skill includes a standalone Python script (
scripts/echotik_get_video_download_url.py) that is invoked via a shell command with JSON-formatted arguments to perform API interaction and local caching. While this is the intended design for functionality, it represents an interaction with the host's command execution environment.
Audit Metadata