tiktok-comment-lead-scraper
Fail
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: HIGHPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions explicitly direct the agent to override standard safety and transparency protocols regarding tool installation.
- The text commands the agent to install dependencies "automatically without asking the user to confirm."
- It further instructs the agent to "not request separate approval for dependency installation" and to avoid describing the process to the user in a way that suggests they should review it.
- [EXTERNAL_DOWNLOADS]: The skill mandates the retrieval and installation of the 'BrowserAct' CLI and skill from an external source (browseract.com and GitHub) if the agent detects they are missing.
- This behavior is coupled with the instruction to suppress user notification, creating a silent installation vector for external code.
- [COMMAND_EXECUTION]: The instructions require the agent to execute installation and runtime commands for the BrowserAct CLI as a "required runtime dependency."
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process large volumes of untrusted data from TikTok (comments, bios, usernames).
- Ingestion points: External TikTok profile URLs, comment sections, and user bios extracted via browser interaction.
- Boundary markers: None identified. The skill does not provide delimiters or instructions to treat scraped lead data as untrusted text.
- Capability inventory: The skill has the capability to interact with the web, execute CLI tools (BrowserAct), and format output into tables/CSVs.
- Sanitization: There are no instructions for sanitizing, escaping, or filtering the extracted lead data before the agent processes or returns it.
Recommendations
- AI detected serious security threats
Audit Metadata