tiktok-ad-library-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_&_EXFILTRATION]: The skill makes network requests to
api.scavio.dev, which is the official API endpoint for the vendor 'scavio-ai'. These requests are for the core functionality of searching and retrieving ad data. - [CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage their API keys via environment variables (
SCAVIO_API_KEY) and provides placeholders (sk_your_key_here) in examples rather than hardcoding actual secrets. This follows standard security best practices for secret management. - [REMOTE_CODE_EXECUTION]: No remote code execution or package installation patterns were detected. The Python and bash examples provided are standard usage snippets for interacting with a REST API.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes external data (TikTok ad content), it does so to return structured JSON data. The guardrails section explicitly instructs the agent to only return what the API provides and not to fabricate content, which mitigates risks associated with processing third-party data.
Audit Metadata