scrapesocial-tiktok

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the scrapesocial command-line tool globally using the Node Package Manager (npm install -g scrapesocial@0.1.0). This is a standard software installation from a well-known public registry.
  • [COMMAND_EXECUTION]: The skill relies on executing the scrapesocial CLI tool with various subcommands (e.g., tiktok users search, tiktok videos get) to perform research and analysis tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill exposes the agent to untrusted data by retrieving and analyzing external TikTok content, which could contain malicious instructions.
  • Ingestion points: Video comments (tiktok videos comments) and audio transcripts (tiktok videos transcript) retrieved from TikTok.
  • Boundary markers: No explicit boundary markers or delimiters are instructed for use when the agent processes the retrieved text.
  • Capability inventory: The agent has the capability to execute shell commands via the scrapesocial tool.
  • Sanitization: There is no evidence of sanitization, filtering, or escaping protocols applied to the external content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 12:55 PM