TikTok Streak Bot

• Outcome: Review
• Latest audit: May 29, 2026 at 9:33 PM UTC
• Version:
  1.0.1

Overview

This is a disclosed TikTok messaging bot, but it stores reusable account cookies in a plain local file and can send scheduled messages automatically, so users should review it carefully before installing.

Install only if you are comfortable giving the skill an authenticated TikTok session and allowing scheduled messages from your account. Use a dedicated or low-risk account, keep data/cookies.json out of shared folders and source control, remove or rotate the session after use, review the recipient list and daily limit before enabling the schedule, and consider TikTok account or policy consequences from automated messaging.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The overview describes automated TikTok messaging using browser simulation, cookie-based session management, and scheduled daily execution, but provides no warning about privacy, platform-policy, or account-security implications. This omission can mislead users into running automation that exposes session cookies, triggers account restrictions, or sends messages without sufficient consent and operational safeguards.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This code persists authenticated TikTok session cookies to a local JSON file without any indication of user consent, disclosure, or protection controls in this file. Stored session cookies are sensitive secrets; if the host, workspace, logs, backups, or shared skill data are accessed by another party, an attacker could reuse them to hijack the TikTok account session without needing credentials or MFA.

Missing User Warnings

High

• Confidence: 92% confidence
• Finding: This manifest explicitly combines automated messaging, persistent file reads/writes, scheduled execution, and network access, but provides no warning or consent language about privacy risks, account actions, or automated outbound behavior. In the context of a TikTok messaging bot, that omission is dangerous because users may unknowingly enable spam-like actions, expose account/session data such as cookies, or trigger account penalties and privacy harm through unattended operation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to export and store authenticated TikTok cookies, which are effectively session credentials that can grant direct account access if copied or leaked. Because this skill relies on browser automation and local file storage, the absence of explicit handling and storage warnings increases the chance that users will save reusable authentication material insecurely, exposing the account to takeover.

VirusTotal

67/67 vendors flagged this skill as clean.