tiktok-account-analyzer
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements html.escape to sanitize all dynamic content fetched from TikTok before including it in the generated HTML report, effectively mitigating potential cross-site scripting (XSS) risks from user-controlled content.
- [COMMAND_EXECUTION]: Subprocess calls in generate_report.py are used solely to open the generated local HTML report in the system's default web browser using standard platform-specific commands such as open or xdg-open.
- [SAFE]: The skill manages API keys by searching environment variables and shell configuration files such as .zshrc or .bashrc. This is a documented convenience feature for credential management and does not involve exfiltration of data.
- [EXTERNAL_DOWNLOADS]: The generated HTML report references the html2canvas library from cdn.jsdelivr.net, which is a well-known and trusted technology service.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from TikTok profiles. 1. Ingestion points: User bios and video descriptions fetched from the RedFox API in scripts/tiktok_account_analyzer.py. 2. Boundary markers: Data is delimited within Markdown and HTML table structures. 3. Capability inventory: Subprocess execution for opening browser instances in scripts/generate_report.py. 4. Sanitization: Implements html.escape to sanitize all user-controlled data before rendering the HTML report.
Audit Metadata