tiktok-android-720p

• Outcome: Review
• Latest audit: May 29, 2026 · 9:33 PM UTC
• Version: 1.0.0

Overview

This skill does what it claims by automating TikTok through Android ADB, but it has review-worthy risks: it can post publicly, upload screenshots to AI providers, and delete videos from a phone camera folder without strong safeguards.

Review before installing. Use only with a dedicated test phone and TikTok account, avoid publish mode unless the camera folder has no personal videos, do not pass untrusted video URLs, and assume AI mode sends screenshots of the TikTok screen to Anthropic, OpenAI, or OpenRouter. Patch the media deletion and add explicit confirmations before using on a real account or personal device.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

Command output
        """
        try:
            result = subprocess.run(
                ["adb", "-s", self.device_id, "shell", command],
                capture_output=True,
                text=True,

• Confidence: 97% confidence
• Finding: result = subprocess.run( ["adb", "-s", self.device_id, "shell", command], capture_output=True, text=True, timeout=timeout

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

self._adb_shell(f"screencap -p {device_path}")

            # Pull screenshot to local machine
            subprocess.run(
                ["adb", "-s", self.device_id, "pull", device_path, save_path],
                capture_output=True,
                timeout=10

• Confidence: 89% confidence
• Finding: subprocess.run( ["adb", "-s", self.device_id, "pull", device_path, save_path], capture_output=True, timeout=10 )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Step 0: Clean up all videos in DCIM/Camera folder
        print(f"\n🧹 Cleaning up all videos in DCIM/Camera...")
        # Delete all video files except .thumbnails folder
        subprocess.run(
            ["adb", "-s", device_id, "shell", "rm -f /sdcard/DCIM/Camera/*.mp4"],
            capture_output=True,
            timeout=10

• Confidence: 98% confidence
• Finding: subprocess.run( ["adb", "-s", device_id, "shell", "rm -f /sdcard/DCIM/Camera/*.mp4"], capture_output=True, timeout=10 )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

capture_output=True,
            timeout=10
        )
        subprocess.run(
            ["adb", "-s", device_id, "shell", "rm -f /sdcard/DCIM/Camera/*.3gp"],
            capture_output=True,
            timeout=10

• Confidence: 98% confidence
• Finding: subprocess.run( ["adb", "-s", device_id, "shell", "rm -f /sdcard/DCIM/Camera/*.3gp"], capture_output=True, timeout=10 )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

device_video_path = f"/sdcard/DCIM/Camera/video_{timestamp}.mp4"

            # Use curl to download directly to device
            curl_result = subprocess.run(
                ["adb", "-s", device_id, "shell", f"curl -L -o {device_video_path} '{video_url}'"],
                capture_output=True,
                timeout=300  # 5 minutes for download

• Confidence: 97% confidence
• Finding: curl_result = subprocess.run( ["adb", "-s", device_id, "shell", f"curl -L -o {device_video_path} '{video_url}'"], capture_output=True, timeo

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents shell/ADB execution, environment-variable API keys, and filesystem operations, but does not declare permissions for env, file_read, file_write, and shell. That deprives users and platforms of informed consent and makes a highly capable automation skill appear less privileged than it really is. In this context, the undeclared capabilities are especially risky because the skill can control a connected device, manipulate media files, and access third-party AI credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose frames the skill as TikTok interaction automation, but the behavior summary includes materially riskier actions: downloading external videos, deleting device media, bulk feed interaction, and storing screenshots/UI dumps. This mismatch can mislead users about the true operational and privacy impact, increasing the chance of unsafe deployment on real devices and accounts. In a social-media automation skill, those hidden or underemphasized behaviors are more dangerous because they affect user data, account safety, and third-party content handling.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The module description understates the actual capability set by presenting the code as a comment bot while it can also install apps, capture screenshots, like/favorite content, and publish videos. This mismatch is dangerous in an agent skill because operators may grant trust or permissions based on incomplete disclosure, enabling broader device control and account actions than expected.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill can capture full-screen device screenshots and pull them to the host, which can expose private messages, credentials, tokens, notifications, or unrelated app content. In an automation/agent context, this materially increases surveillance and data-exfiltration risk beyond normal TikTok interaction needs.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: `publish_video` claims to publish the supplied `video_path`, but the implementation ignores that argument and uploads the first album video visible on the device. This can cause unintended disclosure of private media and breaks caller expectations, making accidental or manipulated publication of the wrong content likely.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill description suggests TikTok interaction and publishing, but this block performs broad deletion of all videos in the device camera folder. In the context of a mobile automation skill, hidden destructive behavior is especially dangerous because users may connect personal devices containing irreplaceable media.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README describes destructive album cleanup and post-publish deletion behavior without a prominent warning about data loss. In the context of an automation tool that operates on a real Android device over ADB, undocumented deletion of media can cause unintended loss of user content on the device.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README promotes AI-based comment generation using third-party APIs but does not clearly disclose that screenshots, video-derived context, prompts, or generated comment content may be transmitted to external providers. Because the skill analyzes TikTok content on a real user account, this creates privacy and data-handling risk for both the operator and viewed content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The publish workflow states it will clean the album by deleting old videos and perform post-publish cleanup, but does not clearly warn that device media may be modified or deleted. This creates a real safety issue: users may connect a personal device and unknowingly allow destructive operations on their photo/video library. The context makes this more dangerous because ADB grants broad device control and the affected data is likely user-generated and non-recoverable.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation says AI comments may use Claude/GPT-4/OpenRouter for visual analysis, but does not clearly disclose that screenshots or video-derived content may be sent to third-party AI services. That is a privacy and data-governance risk, especially if analyzed content contains private media, account details, or copyrighted material from the device/session. In this skill, the danger is elevated because the automation operates on a live social-media app and may collect visual context from user feeds or uploaded media.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script saves screenshots of TikTok search results and videos to local disk without any consent prompt, retention control, or warning about potentially sensitive content being stored. Those images can capture usernames, profile data, recommendations, or private media context and may later be accessed, exfiltrated, or mishandled.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script automatically posts comments to TikTok without requiring per-action confirmation, rate limiting, or a clear warning that it is performing account actions on the user's behalf. In this skill context, that is more dangerous because the tool is explicitly designed for engagement automation, which can cause account abuse, spam, reputational harm, or platform policy violations.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script performs automated TikTok commenting at scale with no user confirmation, rate-limit safeguard, or explicit warning before interacting with a real account. In this skill's context, that is risky because it enables mass platform actions that can violate terms of service, trigger account sanctions, or cause unintended posting from the user's authenticated account.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The code saves screenshots of TikTok search results and video screens to local files without notifying the operator or obtaining consent. In this context, screenshots may capture usernames, comments, profile data, or other personal content, creating unnecessary privacy and retention risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This function reads a local screenshot, base64-encodes it, and sends it to Anthropic for remote processing. That is a real privacy/security concern because screenshots from a mobile automation workflow may contain sensitive personal data, account details, messages, or other on-screen content, and the code provides no consent gate, minimization, or disclosure at the point of transfer.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The OpenAI path sends the entire screenshot as a data URL to an external API. In the context of TikTok/Android automation, screenshots can easily include personal content or credentials, so undisclosed exfiltration to a third party creates a meaningful privacy and compliance risk even if done for intended functionality.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This code transmits screenshot contents to OpenRouter, which may route requests to additional upstream model providers depending on configuration. That broadens the privacy exposure and makes undisclosed screenshot upload especially risky, since users may not understand which third parties process their screen data.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code posts comments directly to a live TikTok account with no explicit confirmation, dry-run mode, or policy guardrails. In agent settings, this creates a real risk of unauthorized account actions, spam, reputational harm, and platform-policy violations if triggered accidentally or by prompt manipulation upstream.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The code publishes videos to a live TikTok account without any user confirmation step before the final upload. Because publishing is a high-impact external side effect, lack of consent and preview creates substantial risk of accidental disclosure, misuse by an upstream agent, and irreversible reputational damage.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code saves a screenshot of TikTok search results to a predictable local file path without any indication of consent, retention limits, or access controls. Search results can contain usernames, profile images, captions, and other potentially sensitive user content, so storing them on disk increases the risk of unintended disclosure if the host is shared, compromised, or logs/artifacts are collected.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.