douyin-scraper-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill interfaces with vendor-owned API endpoints at api.scavio.dev. All network operations are directed to the vendor's infrastructure for the purpose of data retrieval as described in the skill metadata.
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves content from an external platform (Douyin), which presents a surface for indirect prompt injection. Malicious instructions could be embedded in user comments, video descriptions, or profile data.
- Ingestion points: Data returned from all endpoints, particularly video comments, search results, and user profiles.
- Boundary markers: The skill does not define specific delimiters (such as XML tags or unique markers) to isolate external data from the agent's instructions.
- Capability inventory: The skill performs network operations via HTTP POST requests to fetch data.
- Sanitization: No specific sanitization or filtering logic is defined for the content retrieved from the external source.
Audit Metadata