tiktok-automation
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary functionality is to guide the agent through legitimate TikTok API workflows provided by the Rube MCP toolkit. All operations described (uploading, publishing, and listing content) are standard for social media automation tools.
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes external data from TikTok profile metadata and video lists.
- Ingestion points: Data returned by
TIKTOK_LIST_VIDEOS,TIKTOK_GET_USER_PROFILE, andTIKTOK_GET_USER_STATS(SKILL.md). - Boundary markers: None identified; instructions do not specify delimiters to separate untrusted TikTok content from agent instructions.
- Capability inventory: The skill has write capabilities including
TIKTOK_UPLOAD_VIDEO,TIKTOK_PUBLISH_VIDEO, andTIKTOK_POST_PHOTO(SKILL.md). - Sanitization: There are no documented steps for escaping or validating data retrieved from TikTok before processing.
- [EXTERNAL_DOWNLOADS]: The skill requires connection to an external MCP server endpoint (
https://rube.app/mcp) to access the TikTok toolkit. This is a configuration requirement for the skill's core functionality.
Audit Metadata