Tiktok Video Search

• Outcome: Pass
• Latest audit: Jun 6, 2026 at 3:44 AM UTC
• Version:
  1.1.23

Overview

This skill is a disclosed TikTok search helper that uses Gecho Bridge and does not show hidden or destructive behavior.

Before installing, be aware that searches use your logged-in browser session through the Gecho extension and may save TikTok result metadata locally. Use a private workspace directory for saved JSON files and delete them when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the agent to save TikTok search results to a local JSON file and to choose a safe absolute directory path, but it does not warn about local retention, access control, sensitive query contents, or privacy implications of storing scraped account/content metadata on disk. This can lead to unintentional persistence of user research activity or collected creator/video data in shared workspaces or improperly protected directories.

VirusTotal

64/64 vendors flagged this skill as clean.