tiktok-research
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection] (LOW): The skill creates a surface for indirect prompt injection by fetching untrusted text from TikTok and passing it to an AI model for hook and structure analysis.\n
- Ingestion points: Data enters via
fetch_tiktok.py, which retrieves captions, hashtags, and metadata from external TikTok profiles and stores them inraw.json.\n - Boundary markers: No boundary markers or specific instructions (e.g., delimiters or 'ignore embedded commands' warnings) are used when passing this data to the analysis phase.\n
- Capability inventory: The skill requires the
google-genailibrary and references an externalvideo-content-analyzerskill, providing the logic to process gathered content.\n - Sanitization: There is no evidence of sanitization or content filtering for the retrieved TikTok text before it is processed by the AI components.\n- [External Downloads] (SAFE): The skill utilizes the Apify TikTok Scraper (Actor ID
GdWCkxBtKWOsKjdch). This is a known and legitimate scraper on the Apify platform, and its use is consistent with the primary purpose of the skill.
Audit Metadata