TikTok Search

ReviewAudited by ClawScan on May 13, 2026.

Overview

This is a coherent TikTok research skill, but it depends on external Gecho components and a logged-in TikTok browser session that users should trust before using.

Before installing, make sure you trust the Gecho Bridge MCP package and Chrome extension, and consider using a separate Chrome profile or TikTok account for research. Save exports only to intended paths and remove or disable the bridge/extension when you no longer need them.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The Gecho components may use the TikTok session you have open in Chrome to perform searches or collect visible TikTok data.

Why it was flagged

The skill relies on a logged-in TikTok browser session and third-party bridge/extension components. That is account/session authority, but it is disclosed and fits the TikTok search purpose.

Skill content
Requires the Gecho Bridge MCP server plus the Gecho Chrome extension and an active TikTok session.
Recommendation

Use only with a TikTok account/session you are comfortable connecting, and disable the extension or log out when you no longer need it.

What this means

Future installs may run whatever version is current in the external package source at that time.

Why it was flagged

The setup uses an external npm package with the @latest tag, so the executed MCP server code is not pinned or included in this skill review.

Skill content
openclaw mcp set gecho-bridge '{"command":"npx","args":["-y","@gecho-ai/gecho-bridge@latest"]}'
Recommendation

Install only if you trust the Gecho package source, and consider pinning a reviewed version if your environment requires reproducible installs.

What this means

TikTok search requests and returned metadata may pass through external local/browser components.

Why it was flagged

The workflow depends on communication between the AI agent, an MCP server, a local/browser extension component, and TikTok session context. The artifact discloses this, but the implementation details are outside the provided files.

Skill content
the `gecho-bridge` MCP server ... the Gecho Chrome extension ... a logged-in TikTok session in Chrome
Recommendation

Review the Gecho Bridge and Chrome extension documentation/permissions before use, especially in sensitive browsing profiles.

What this means

A local Gecho service may continue to be available while the plugin/MCP setup is active.

Why it was flagged

A local background service may be started for the integration. This is disclosed and tied to the stated workflow, with no evidence of hidden or self-propagating behavior.

Skill content
When using the plugin route, Gecho Bridge may auto-start a local service process to talk to the Chrome extension.
Recommendation

Know how to stop or remove the MCP/plugin setup if you no longer want the local service running.