Skills
Navigate
skills/yulin7645/tiktok-skills/tiktok-collection-scraper/Gen Agent Trust Hub

tiktok-collection-scraper

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from TikTok video descriptions and stores it in the output JSON. This creates a surface for indirect prompt injection if a downstream agent interprets this data as instructions. \n
  • Ingestion points: scripts/scrape_collections.py extracts the desc field from TikTok's item_list API responses. \n
  • Boundary markers: The skill does not implement delimiters or warnings to separate scraped content from instructions in its output. \n
  • Capability inventory: The skill possesses network access and filesystem write capabilities. \n
  • Sanitization: No sanitization or instruction filtering is performed on the scraped video descriptions. \n- [EXTERNAL_DOWNLOADS]: The skill documentation and scripts require the curl_cffi Python package, which is a well-known and reputable library for TLS impersonation in web scraping.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 03:11 AM