Tiktok Ugc Creator

• Outcome: Review
• Latest audit: May 28, 2026 at 11:53 AM UTC
• Version:
  0.1.0

Overview

This skill appears purpose-aligned for hiring TikTok UGC creators, but it gives agents authenticated API workflows that can create paid campaigns and handle creator personal data without clear approval, budget, or privacy guardrails.

Review before installing. Use only with a scoped PingHuman token if available, require explicit human approval before any paid task creation or approval, set a campaign budget and deadline, avoid pasting long-lived secrets into prompts, handle creator shipping addresses as personal data, and require clear paid/sponsored content disclosure for any creator output.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow explicitly instructs operators to collect creators' shipping addresses, which is personal data, but provides no warning about privacy obligations, secure handling, minimization, retention, or consent. In a skill intended for agent automation, this omission can lead agents or users to gather and process sensitive contact information without adequate safeguards, increasing privacy and compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.