ecommerce-tiktok-video-search
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Python script (
scripts/tiktok_video_search.py) that accepts a JSON parameter string via command line. The script safely parses this input usingjson.loadsand performs no dangerous shell operations or sub-process spawning with user-controlled input. - [EXTERNAL_DOWNLOADS]: The script performs network requests to the endpoint defined by the
NEXSCOPE_PROXY_BASEenvironment variable. This is a standard vendor-controlled API proxy for accessing EchoTik data. These requests are for data retrieval and do not download or execute remote code. - [DATA_EXFILTRATION]: While the skill makes network calls, it only sends user-defined search parameters (region, filters) to the vendor's API. It requires a
NEXSCOPE_API_KEYfor authentication, but uses it standardly in the Authorization header. No attempts to access or transmit sensitive local files (like SSH keys or AWS credentials) were found. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the external EchoTik API (video descriptions, metrics). The instructions in
SKILL.mdadvise the agent to present this data in tables and link to original videos. While the external data could theoretically contain injection attempts, the skill is used for data analysis rather than code execution or system modification, which limits the risk surface to standard data processing.
Audit Metadata