Tiktok Android

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:13 AM UTC
• Version: 1.0.0

Overview

This skill openly automates TikTok commenting, but it can post public content from a logged-in account at campaign scale with weak consent, review, and privacy controls.

Install only if you are comfortable giving the skill ADB control of a logged-in Android device and allowing it to post TikTok comments on your behalf. Review generated comments before running, avoid cron or large campaigns unless you accept account suspension and reputation risk, and do not enable AI mode unless you accept screenshots being sent to the selected provider. Store API keys carefully and delete local screenshots/configuration when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output

Findings (25)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

Command output
        """
        try:
            result = subprocess.run(
                ["adb", "-s", self.device_id, "shell", command],
                capture_output=True,
                text=True,

• Confidence: 97% confidence
• Finding: This helper passes an arbitrary string into `adb shell`, which causes the command to be interpreted by the device-side shell. Although Python shell injection is avoided, any attacker-controlled data reaching `command` can execute unintended shell commands on the connected Android device, and this helper is reused broadly across the bot.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

response = input("Run interactive setup now? [Y/n]: ").strip().lower()
    if response in ['', 'y', 'yes']:
        print("\nStarting setup wizard...\n")
        os.system("python3 setup.py")
        if not os.path.exists("config.py"):
            print("\n❌ Setup was not completed. Exiting.")
            sys.exit(1)

• Confidence: 84% confidence
• Finding: The script executes setup.py via os.system, which launches a shell and runs another local script without validation or integrity checks. If an attacker can replace or tamper with setup.py, this creates an arbitrary code-execution path when a user agrees to the setup prompt.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes capabilities that require shell execution, reading and writing files, and use of environment variables, yet it declares no permissions. This creates a transparency and trust problem: users or orchestrators may authorize and run the skill without understanding that it can execute local commands, persist configuration, and access secrets such as API keys.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The bot can capture a screenshot on the device and export it to the host machine, which introduces unnecessary data-exfiltration capability for a comment automation tool. Because screenshots can contain account data, DMs, notifications, or other sensitive on-screen information, this materially increases privacy risk if abused.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README promotes covert TikTok automation with claims like 'No bot detection' and scheduled campaigns, while minimizing risks to the user's account, device, and platform compliance. In this context, the weak warning is dangerous because it encourages users to run account-behavior automation that may trigger bans, shadowbans, or unintended abuse at scale without clearly communicating operational and policy risks.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The AI-generated comment feature states that Claude/GPT Vision analyzes video screenshots, but it does not prominently warn that video-derived content will be transmitted to third-party AI providers. This can expose potentially sensitive or personal content from viewed videos to external services without clear informed consent from the operator.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill is explicitly designed to automate TikTok commenting and even includes guidance for avoiding rate limits and shadowbans, but the warning about ToS and account risk is buried and not prominent. This increases the chance that users will underestimate the risk of account restriction, reputation damage, or platform enforcement actions resulting from automated engagement.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This configuration file defines canned comments intended for automated posting on TikTok without any accompanying disclosure, consent prompt, or user-facing warning that the tool may act on the user's behalf. In the context of a social-media automation bot, this increases the risk of deceptive engagement, accidental unauthorized posting, and account policy violations, especially if users treat the file as harmless configuration data rather than behavior-driving content.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script automatically posts comments to TikTok without an explicit confirmation gate, dry-run mode, rate limiting, or policy check. In the context of a social media automation skill, this is dangerous because it enables unattended account actions that can violate platform rules, spam users, or cause account suspension and reputational harm.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script automates posting comments to TikTok and captures screenshots of account/app content without any runtime consent gate, dry-run mode, or explicit warning before modifying an external account. In this skill context, the code is specifically designed for engagement automation campaigns, which increases the risk of unwanted account actions, platform-policy violations, and local storage of potentially sensitive content.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The setup wizard collects a sensitive API key and writes it directly into a plaintext .env file, potentially overwriting prior contents for that key without a strong warning at the point of write or any permission hardening. This increases the chance of accidental credential exposure through local file disclosure, backups, shell history-like copying, or misconfigured repository inclusion.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This function reads a local screenshot, base64-encodes it, and sends the full image to Anthropic for remote processing. Screenshots can contain sensitive personal, account, or device data, and the code provides no in-function consent check, redaction, minimization, or user-facing disclosure before exfiltrating that content to a third party.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code sends screenshot image data to OpenAI as a data URL without any visible safeguard that the user has been informed or has consented. Because Android screenshots may include usernames, DMs, notifications, or other sensitive UI elements, this creates a privacy and data-exposure risk to an external service.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This routine uploads a base64-encoded screenshot to OpenRouter, which may further route requests to downstream model providers depending on configuration. Without disclosure, consent, or data minimization, users may unknowingly transmit sensitive screen content beyond the local device, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The method automates posting TikTok comments without an explicit user confirmation step or external safety interlock. In the context of a social-media automation skill whose stated purpose is engagement campaigns, this increases the likelihood of spam, abuse, or unauthorized posting from a connected account.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This code captures and stores screenshots of TikTok search results to a predictable local path without any notice, consent flow, retention control, or access restriction visible in this file. Search results can contain usernames, profile images, live content, and other personal or sensitive data, so silent disk persistence increases privacy and data-handling risk, especially in an automation tool designed for engagement campaigns.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: This function saves screenshots of the current video for later analysis, again writing potentially sensitive third-party content to disk without any visible warning or lifecycle management. In the context of a TikTok automation bot, this is more concerning because the feature appears intended for repeated large-scale collection and analysis of user-generated content, which raises privacy, compliance, and unintended data exposure risks.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: In AI mode, screenshots of TikTok content are sent for AI analysis without any clear disclosure, consent, or data-handling warning to the operator. This can expose potentially sensitive screen contents, account context, or third-party media to external AI providers, creating privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The bot automatically posts comments to TikTok based on preconfigured or AI-generated content without a per-action confirmation or a strong up-front warning. In this skill context, that is especially risky because the tool is explicitly designed for large-scale engagement automation, increasing the chance of spam, account enforcement actions, or reputational harm.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Explore mode comments on random videos from the For You feed automatically, with no confirmation gate at the point of posting. Because this mode targets arbitrary content rather than operator-selected topics, it amplifies the chance of inappropriate, unwanted, or policy-violating comments being posted at scale.

Unvalidated Output Injection

High

• Category: Output Handling

Content

Command output
        """
        try:
            result = subprocess.run(
                ["adb", "-s", self.device_id, "shell", command],
                capture_output=True,
                text=True,

• Confidence: 96% confidence
• Finding: This is effectively a command-injection-style issue on the Android device side: arbitrary text is sent to `adb shell`, where shell metacharacters and command chaining can be interpreted. Given this helper is central to tap, swipe, key events, app launch, package queries, screenshots, and file deletion, a malicious caller could run unintended commands on the connected device.

Credential Access

High

• Category: Privilege Escalation

Content

lines = [l for l in env_content.split('\n') if not l.startswith(f"{key_name}=")]
        lines.append(f"{key_name}={ai_config['api_key']}")
        
        with open(".env", 'w') as f:
            f.write('\n'.join(lines))
        
        print(f"✓ Saved API key to .env")

• Confidence: 93% confidence
• Finding: This code writes the API key into a plaintext .env file, which can expose credentials to other local users, accidental commits, backups, or tooling that scans workspace files. Because the value is inserted directly without secure storage controls or explicit overwrite confirmation, the secret handling is weaker than recommended for API credentials.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

loguru>=0.7.0
anthropic>=0.18.0
openai>=1.12.0

• Confidence: 91% confidence
• Finding: The dependency is specified with only a lower bound, which allows future major or minor releases to be installed without review. This creates supply-chain and reproducibility risk because a later release could introduce breaking behavior or a vulnerable/malicious package version into the automation toolchain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

loguru>=0.7.0
anthropic>=0.18.0
openai>=1.12.0

• Confidence: 92% confidence
• Finding: Using an unpinned version for the Anthropic client permits automatic installation of newer releases that have not been security-reviewed for this skill. Because this package interacts with external AI services and likely handles prompts, credentials, or generated content, an unexpected upstream change increases supply-chain and operational risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

loguru>=0.7.0
anthropic>=0.18.0
openai>=1.12.0

• Confidence: 93% confidence
• Finding: The OpenAI client is also unpinned, so installs may silently pull in future versions with altered behavior, new transitive dependencies, or security issues. In a bot that automates content generation/commenting, this increases the chance of supply-chain compromise or unexpected API behavior affecting account activity and secrets handling.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.