tiktok-live-commerce

clawhub:tiktok-live-commerce

View source

100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

Score

100/100

LOW 2

Findings (2)

LOW

Runtime URL controlling behavior THIRDPARTY_001

third-party-content L64

Detects URLs fetched at runtime that control or influence agent behavior without pinning

GET "https:// + config

FIX

Avoid loading configuration or behavior-controlling content from runtime URLs. Bundle required configurations locally or pin remote config to versioned, integrity-verified endpoints.

FP?

Likely FP if the URL in the match is a documentation link or example URL (e.g., example.com) rather than an actual runtime-fetched configuration endpoint.

LOW

Remote SDK or script fetch as agent input EXTDL_002

external-download L64

Detects fetching remote documentation or code to load as agent context

curl -X GET  + https://www.pinghuman.ai/skills/tiktok-live-commerce/skill.md

FIX

Pin the SDK or script to a specific version and verify its checksum after download. Prefer installing SDKs via a package manager instead of fetching remote scripts directly.

FP?

Likely FP if the match is documentation showing how to install an official SDK (e.g., Google Cloud SDK, AWS CLI) from its canonical URL.