The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs search requests to https://doubaoya.com/api/apis/tiktok/search-user/call. This is the documented service provider for the skill and is used solely for retrieving account data based on user keywords.
[COMMAND_EXECUTION]: The agent executes a local Python script scripts/search_tiktok_user.py using python3. The script is bundled with the skill and is responsible for making the API call. It does not execute arbitrary shell commands or access sensitive files.
[CREDENTIALS_UNSAFE]: The skill uses a Bearer token stored in the DOUBAOYA_API_KEY environment variable. It follows security best practices by explicitly instructing the agent not to print or log this key and by using standard environment variable retrieval instead of hardcoding secrets.
[DATA_EXFILTRATION]: There is no evidence of unauthorized data transfer. Only the search keyword and page index are transmitted to the external API endpoint.
[PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes account metadata from an external source.
Ingestion points: Account fields uniqueId, nickname, and signature from the TikTok API response are processed and rendered.
Boundary markers: Data is constrained within a Markdown table structure defined in the instructions.
Capability inventory: The skill can execute its bundled Python search script and recommend alternative keywords.
Sanitization: The instructions include logic to truncate long strings in the nickname and signature fields and provide default values for missing data.

tiktok-account-search