douyin-audit
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted user-supplied data, such as video titles, descriptions, and subtitles, and interpolates them into generated HTML and Markdown reports. This creates a potential surface for indirect injection if malicious payloads are included in the source content.\n
- Ingestion points: Step 1 of the workflow in
SKILL.mdidentifies video metadata and transcriptions as primary inputs.\n - Boundary markers: Absent; there are no specific instructions for the agent to use delimiters or ignore embedded commands in the untrusted input.\n
- Capability inventory: The skill is capable of writing to the local file system to generate
.htmland.mdreports.\n - Sanitization: Absent; no instructions are provided to sanitize or escape user-controlled strings before they are rendered into the report templates.\n- [EXTERNAL_DOWNLOADS]: The skill references official creator guidelines from ByteDance's Douyin developer platform for content policy compliance.
Audit Metadata