tiktok-scraper-api
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides integration with the Scavio TikTok API. All external network requests are directed to
api.scavio.dev, which is the official domain for the skill's author (scavio-ai). - [SAFE]: Credential management follows security best practices by instructing users to use environment variables (
SCAVIO_API_KEY) rather than hardcoding secrets in scripts. The provided code examples use placeholders likesk_your_key_hererather than active credentials. - [SAFE]: The Python package
langchain-scaviolisted in the documentation is a vendor-owned integration library for the Scavio platform. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from TikTok (comments, bios, video descriptions) which is user-generated and technically untrusted. However, the skill only returns this data as structured JSON and includes guardrails instructing the agent to only return API data and not fabricate content. Given the standard RAG/Search use case, this represents a typical surface for indirect injection with low risk.
Audit Metadata