TikTok Streak Bot
v1.0.1Browser-automated TikTok streak messaging skill using Playwright. Sends daily messages to configured usernames with state tracking, retry control, and option...
⭐ 1· 77·0 current·0 all-time
byMahmoud Mohamed@mrblackeg
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (TikTok streak bot) match the code and SKILL.md: Playwright automation, cookie-based session restoration, username list, state tracking and optional content discovery. Declared permissions (filesystem.read, filesystem.write, network.http) and the inputs (paths to config, usernames, cookies, state) are proportional and expected for this functionality.
Instruction Scope
SKILL.md and main.py restrict actions to loading config/state, restoring cookies, visiting TikTok pages, sending messages, and persisting cookies/state. These instructions do require you to supply authenticated cookies (sensitive). The instructions do not direct the agent to read unrelated system files or send data to any non-TikTok endpoints, but they do persist cookies.json and a log file under data/, which is expected for session maintenance but increases the sensitivity of the local files.
Install Mechanism
There is no automated install spec in the manifest (instruction-only installation). The SKILL.md tells the user to run pip install -r scripts/requirements.txt and playwright install chromium — standard for Playwright Python projects. No remote arbitrary archives or obscure download hosts are used in the repository.
Credentials
The skill declares no required environment variables or external credentials. It instead relies on user-provided data/cookies.json for authenticated sessions. That is proportional to the purpose but worth flagging because cookies are effectively session credentials; the skill reads and writes those cookie files locally (sensitive data).
Persistence & Privilege
The skill is not always-included and allows autonomous invocation by default (platform normal). It persists its own state and cookies under its data/ directory only and does not modify other skills or global agent config. The scheduled cron metadata is consistent with a daily-run streak bot.
Assessment
This repository is internally consistent with its stated purpose, but you should treat data/cookies.json as highly sensitive: providing authenticated TikTok cookies gives the skill access to your account session and the skill will save cookies back to disk. Before running, you should: (1) review the code (already done here) and, if possible, run it in an isolated environment or throwaway TikTok account; (2) store cookies securely and consider removing them after use; (3) be aware that automated messaging may violate TikTok's terms and risk account action; (4) ensure you trust the source — although no external exfiltration endpoints were found in the code, a malicious change could be introduced later, so prefer running from local audited copy rather than an untrusted remote install.Like a lobster shell, security has layers — review code before you run it.
latestvk973qb23swt13gm1mkx9b8ygvh84n1cw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.