skills/nexscope-ai/nexscope-ecommerce-skills/ecommerce-tiktok-video-download-url/Gen Agent Trust Hub
ecommerce-tiktok-video-download-url
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
scripts/echotik_get_video_download_url.pyto handle TikTok video URL resolution, caching, and data management. - [EXTERNAL_DOWNLOADS]: The skill's script makes network requests to an external API endpoint defined by the
NEXSCOPE_PROXY_BASEenvironment variable to fetch video details from the vendor's proxy service. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external TikTok video links, which could serve as a vector for indirect prompt injection if the video metadata contains malicious instructions designed to influence the agent.
- Ingestion points: TikTok video URLs provided by the user and the resulting JSON metadata (such as video IDs or future metadata fields) returned by the API response.
- Boundary markers: The skill instructions do not define specific delimiters or instructions for the agent to ignore potentially malicious text embedded in the fetched media metadata.
- Capability inventory: The skill uses
scripts/echotik_get_video_download_url.py, which is capable of network communication and writing files to the local project directory. - Sanitization: The script parses the API response as JSON but does not sanitize text content before it is interpreted by the agent.
Audit Metadata