tiktok-shop-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from the TikTok Shop API, including product descriptions, titles, and customer reviews, which are presented to the AI agent.
- Ingestion points: External data enters the agent's context via JSON responses from the
api.scavio.devendpoints as shown in the examples inSKILL.md. - Boundary markers: The instructions do not specify the use of delimiters (e.g., XML tags or special quotes) to isolate external content from the agent's reasoning process.
- Capability inventory: The skill has the capability to perform network requests using the
requestslibrary and execute shell-basedcurlcommands. - Sanitization: No explicit logic is provided to sanitize or filter potentially malicious instructions embedded within product descriptions or user-generated review text.
Audit Metadata