The Agent Skills Directory

[SAFE]: The skill uses an environment variable (TIKHUB_API_KEY) for API authentication, which is the recommended practice for managing sensitive credentials.
[SAFE]: Network operations are confined to the official TikHub API domain (api.tikhub.io), aligning with the skill's stated purpose and the author's identity.
[INDIRECT_PROMPT_INJECTION]: The skill fetches untrusted third-party content (comments, user profiles, video metadata) from Douyin, which serves as a potential vector for indirect prompt injection.
Ingestion points: API responses from Douyin endpoints (e.g., /fetch_video_comments, /handler_user_profile) in SKILL.md.
Boundary markers: Absent; the skill does not specify delimiters for the fetched data.
Capability inventory: Shell command execution via curl for API requests.
Sanitization: Not specified; the skill relies on the agent's default handling of API response data.

douyin