ecommerce-tiktok-video-download-url

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python script scripts/echotik_get_video_download_url.py to handle TikTok video URL resolution, caching, and data management.
  • [EXTERNAL_DOWNLOADS]: The skill's script makes network requests to an external API endpoint defined by the NEXSCOPE_PROXY_BASE environment variable to fetch video details from the vendor's proxy service.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external TikTok video links, which could serve as a vector for indirect prompt injection if the video metadata contains malicious instructions designed to influence the agent.
  • Ingestion points: TikTok video URLs provided by the user and the resulting JSON metadata (such as video IDs or future metadata fields) returned by the API response.
  • Boundary markers: The skill instructions do not define specific delimiters or instructions for the agent to ignore potentially malicious text embedded in the fetched media metadata.
  • Capability inventory: The skill uses scripts/echotik_get_video_download_url.py, which is capable of network communication and writing files to the local project directory.
  • Sanitization: The script parses the API response as JSON but does not sanitize text content before it is interpreted by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 04:14 AM