Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Tiktok Bulk Publisher Final
v1.0.0Automate batch uploading and publishing of TikTok videos with customizable titles, privacy, and interaction settings via OAuth 2.0 authorized API.
⭐ 0· 78·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, SKILL.md, README, and tiktok_publisher.py all describe TikTok bulk publishing and use the TikTok Content Posting API endpoints (open.tiktokapis.com). The included code implements chunked uploads, init/finalize calls, and status checks consistent with that purpose. However, registry metadata declares no required environment variables while SKILL.md and the code expect TikTok client_key, client_secret, and access_token — an inconsistency in declared vs. actual requirements.
Instruction Scope
SKILL.md instructs setting OAuth-related environment variables and running the Python script or using its Python API. The instructions and code restrict actions to local video files and calls to the TikTok API; they do not ask the agent to read unrelated system files, secrets, or send data to unexpected external endpoints. (Note: the shipped code was truncated in the provided data, so final lines were not visible.)
Install Mechanism
There is no install spec (no downloads or installers). The skill is distributed as source files (Python + metadata). This is lower risk than arbitrary remote downloads; required dependencies are normal Python libs (requests, pathlib).
Credentials
The code and SKILL.md require OAuth credentials (TIKTOK_CLIENT_KEY, TIKTOK_CLIENT_SECRET, TIKTOK_ACCESS_TOKEN). The registry metadata lists no required environment variables or primary credential — that mismatch is a red flag (the skill will need secrets but the registry doesn't declare them). Confirming how/where you provide tokens and whether the skill persists them is important.
Persistence & Privilege
The skill is not marked always:true and is user-invocable; it can be invoked autonomously (platform default), which is expected for skills of this type. The package does not request system-wide configuration changes in the provided files.
What to consider before installing
This package appears to implement the TikTok bulk-publish functionality it advertises, but there are inconsistencies you should address before installing:
- Verify required credentials: SKILL.md and the Python code expect TikTok OAuth values (client key/secret and an access token). The registry metadata does not declare these. Do not provide credentials until you confirm where they will be stored and used.
- Review the full source: the provided tiktok_publisher.py is the primary runtime code — inspect the full file (untruncated) to ensure there are no hidden endpoints or code paths that transmit data to third-party servers. From the visible code, network calls target open.tiktokapis.com only.
- Token handling: check whether the code stores refresh tokens or access tokens to disk or remote servers. Prefer short-lived tokens and avoid pasting long-lived keys into consoles you don't control.
- Verify repository / provenance: package.json references a GitHub repo and an author email; confirm the repository and recent commits to establish trust (this package's source/homepage was marked unknown/none in the registry data).
- Run in isolation: when testing, run in an isolated environment (separate account or container) and monitor outbound network traffic to confirm only TikTok API endpoints are contacted.
If you want, I can: (1) request or analyze the full/untruncated tiktok_publisher.py, (2) check the declared repository URL for matching code, or (3) produce a short checklist for securely creating and provisioning TikTok OAuth credentials for this skill.Like a lobster shell, security has layers — review code before you run it.
latestvk97faege99w2zwe2annt0jm009838ye0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.