pinchtab-tiktok-media-extraction
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto interact with the PinchTab API and download media files from TikTok. This is standard behavior for an extraction tool. - [COMMAND_EXECUTION]: It generates and executes several Python scripts locally using bash heredocs to parse JSON data. This is a common pattern for handling structured data in shell-based workflows.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it ingests untrusted hydration data from TikTok and uses the resulting strings as arguments in shell commands. Ingestion points: TikTok hydration payload processed in SKILL.md. Boundary markers: None. Capability inventory: Subprocess execution via
curlandpython3, file system access. Sanitization: Uses shell quoting for variables, but lacks explicit validation of the extracted URLs.
Audit Metadata