scrapesocial-tiktok
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install the
scrapesocialcommand-line tool globally using the Node Package Manager (npm install -g scrapesocial@0.1.0). This is a standard software installation from a well-known public registry. - [COMMAND_EXECUTION]: The skill relies on executing the
scrapesocialCLI tool with various subcommands (e.g.,tiktok users search,tiktok videos get) to perform research and analysis tasks. - [INDIRECT_PROMPT_INJECTION]: The skill exposes the agent to untrusted data by retrieving and analyzing external TikTok content, which could contain malicious instructions.
- Ingestion points: Video comments (
tiktok videos comments) and audio transcripts (tiktok videos transcript) retrieved from TikTok. - Boundary markers: No explicit boundary markers or delimiters are instructed for use when the agent processes the retrieved text.
- Capability inventory: The agent has the capability to execute shell commands via the
scrapesocialtool. - Sanitization: There is no evidence of sanitization, filtering, or escaping protocols applied to the external content before it is processed by the agent.
Audit Metadata