tikhub-rest-api
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides functional
curlcommand templates for the agent to execute in a shell environment to interact with the TikHub API. - [DATA_EXFILTRATION]: The skill initiates network requests to the vendor's official domains,
api.tikhub.ioandapi.tikhub.dev. These operations are consistent with the skill's primary purpose of providing direct REST API access and do not target non-vendor or unauthorized external domains. - [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where untrusted user input, such as social media handles (
username), video identifiers (aweme_id), or search terms (keyword), is interpolated into shell commands. - Ingestion points: User-provided parameters are used in query strings for
curlcalls inSKILL.md. - Boundary markers: None provided in the command templates.
- Capability inventory: The skill uses
curlfor network requests. - Sanitization: No explicit sanitization logic is provided in the instructions for the agent to apply to user inputs before command execution.
Audit Metadata