TikTok Crawling (yt-dlp)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:29 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent TikTok scraping guide, but it normalizes using browser session cookies and unattended scheduled scraping without enough safeguards.

Review this before installing if you plan to use authenticated TikTok access. Prefer public-only scraping, avoid using your main Chrome profile, do not put cookie files in shared or version-controlled folders, and do not enable the cron job unless you understand how to monitor and remove it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10-15 **Vulnerability Type**: Supply-chain exposure through mutable, unverified dependencies **Risk Level**: Medium ```bash # macOS brew install yt-dlp ffmpeg # pip (any platform) pip install yt-dlp # Also install ffmpeg separately for merging/post-processing ``` ### Technical Analysis The setup instructions install the latest available versions of `yt-dlp`, FFmpeg, and their dependencies without version constraints, package hashes, signatures, or an explicitly trusted package source. The effective software installed can therefore change after the Skill has been reviewed. This does not demonstrate that the named packages are malicious. However, it creates supply-chain exposure because package installation may execute package-controlled build or installation logic. The risk increases when a user has configured an untrusted Python package index, package mirror, Homebrew tap, or proxy. ### Attack Path 1. An attacker compromises a package release, dependency, configured package index, mirror, or Homebrew source. 2. The user follows the documented installation command without verifying the resolved version or artifact. 3. The package manager downloads and installs the attacker-controlled artifact. 4. Installation hooks or the installed executable run with the privileges of the user invoking the package manager. 5. The attacker can access or modify resources available to that account. If the user unnecessarily runs the installation with administrative privileges, the impact may extend to system-wide resources. ### Impact Assessment Successful exploitation could result in arbitrary code execution under the installing user's account. This could expose downloaded TikTok data, browser-accessible credentials, local project files, and any other resources available to that user. System-wide compromise would require the installation to be performed with elevated privileges or a separate privilege ...[truncated 28 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `yt-dlp` and other dependencies to reviewed versions. - For Python installations, provide a lock file or requirements file containing cryptographic hashes and install with hash verification, such as `pip install --require-hashes`. - Explicitly use a trusted package index and review any configured extra indexes or mirrors. - Where supported, verify release signatures or checksums for FFmpeg and other binary distributions. - Install dependencies in an isolated virtual environment rather than into the system Python environment. - Do not run package installation commands with administrative privileges unless strictly required. - Document a controlled dependency-update and security-review process. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:193
• Finding: Broad Browser Cookie Access for Scraping and Unattended Jobs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 193-226 **Vulnerability Type**: Excessive access to browser authentication material **Risk Level**: Medium ```bash # Use cookies from browser (recommended) yt-dlp --cookies-from-browser chrome "https://www.tiktok.com/@handle" # Or export cookies to a file first yt-dlp --cookies tiktok_cookies.txt "https://www.tiktok.com/@handle" ``` The scheduled scraping example also enables browser-cookie extraction: ```bash for handle in $HANDLES; do echo "[$(date)] Scraping @$handle" yt-dlp "https://www.tiktok.com/@$handle" \ -P "$DATA_DIR" \ -o "%(uploader)s/%(upload_date)s-%(id)s/video.%(ext)s" \ --write-info-json \ --download-archive "$ARCHIVE" \ --cookies-from-browser chrome \ --dateafter "$(date -u -v-7d +%Y%m%d)" \ --sleep-interval 2 \ --max-sleep-interval 5 done ``` ### Technical Analysis The `--cookies-from-browser chrome` option authorizes `yt-dlp` to access Chrome's cookie storage. This introduces access to sensitive authentication material that is unnecessary when retrieving publicly available content. The scheduled example repeats this access automatically and without interactive review. The documented alternative stores cookies in a plaintext file named `tiktok_cookies.txt`, but it provides no file-permission, storage, rotation, or deletion guidance. Local users, backup systems, logs, or other processes may consequently gain access if the file is handled insecurely. There is no evidence in the reviewed file that cookies are intentionally exfiltrated. The security concern is the unnecessary expansion of privileges and the resulting exposure if `yt-dlp`, one of its dependencies, the scraping script, or the local account is compromised. ### Attack Path 1. The user runs the command with access to a normal Chrome profile or exports authenticated cookies into `tiktok_cookies.txt`. 2. `yt-dlp` or the scheduled script receives access to the authenticatio ...[truncated 1067 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not use authentication when scraping content that is publicly accessible. - Make cookie use opt-in rather than the recommended default. - Use a dedicated browser profile containing only the minimum TikTok session required for the task. - Prefer a narrowly scoped cookie file over granting access to a primary browser profile. - Store cookie files outside the project tree with permissions restricted to the owner, such as mode `0600`. - Exclude cookie files from version control, backups, logs, and shared directories. - Rotate and revoke sessions after use, and securely delete exported cookie files when no longer required. - Avoid browser-cookie extraction in unattended cron jobs unless authenticated recurring access is essential. - Run scheduled jobs under a dedicated, unprivileged operating-system account with restricted filesystem access. - Use absolute executable and script paths in cron, protect the script from modification by other users, and document how to remove the cron entry. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (7)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

l updates:

```bash
yt-dlp "https://www.tiktok.com/@handle" \
  -P "./tiktok/data" \
  -o "%(uploader)s/%(upload_date)s-%(id)s/video.%(ext)s" \
  --write-info-json \
  --download-archive "./tiktok/downloaded.txt"
```

Run the same command later—it skips videos already in `downloaded.txt`.

### Authentication (Private/Restricted Content)

```bash
# Use cookies from browser (recommended)
yt-dlp --cookies-from-browser chrome "https://www.tiktok.com/@handle"

# Or export cookies to a file first
yt-dlp --cookies tiktok_cookies.txt "https://www.tiktok.com/@handle"
```

### Scheduled Scraping (Cron)

```bash
# crontab -e
# Run daily at 2 AM, log output
0 2 * * * cd /path/to/project && ./scripts/scrape-tiktok.sh >> ./tiktok/logs/cron.log 2>&1
```

Example `scripts/scrape-tiktok.sh`:

```bash
#!/bin/bash
set -e

HANDLES="handle1 handle2 handle3"
DATA_DIR="./tiktok/data"
ARCHIVE="./tiktok/downloaded.txt"

for handle in $HANDLES; do
  echo "[$(date)] Scraping @$handle"
  yt-dlp "https://www.tik

• Confidence: 90% confidence
• Finding: The `--cookies-from-browser chrome` instruction matches information-stealer patterns because it directs extraction of browser-stored session cookies for authenticated access. Even though presented for scraping, this technique handles sensitive session artifacts and can be repurposed for account access or exfiltration if copied into agent workflows.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The manifest description says 'Use for TikTok crawling, content retrieval, and analysis,' which is a very broad activation scope for a markdown/manifest context. It does not define specific trigger phrases, boundaries, or exclusion conditions, so ordinary requests about TikTok content analysis could unintentionally match this skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly recommends extracting browser cookies and using exported cookie files to access private or restricted TikTok content. That expands the skill from public content retrieval into authenticated session use, which can expose sensitive account data and normalize credential/session-token handling without user safeguards.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation omits a warning that browser-cookie extraction uses an authenticated session and may expose sensitive account access to the tool or downstream logs/files. In this context, lack of warning is dangerous because the skill directly instructs users to access private or restricted content using session material.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The scheduled scraping section persists repeated execution via cron and includes a shell script that performs authenticated scraping with browser cookies. This broadens the skill from ad hoc retrieval into unattended host-level automation that can continuously access an authenticated account and accumulate data over time.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Scheduled Scraping (Cron)

```bash
# crontab -e
# Run daily at 2 AM, log output
0 2 * * * cd /path/to/project && ./scripts/scrape-tiktok.sh >> ./tiktok/logs/cron.log 2>&1
```

• Confidence: 89% confidence
• Finding: The cron example establishes persistent, unattended execution, which increases risk by enabling continuous scraping, ongoing authenticated access, and long-term data collection without repeated user review. Persistence is especially sensitive here because the adjacent script also uses browser-derived cookies.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The skill provides commands that download videos and write '.info.json', CSV, JSON, and archive files to local directories, but it does not explicitly warn that these operations create persistent local copies of media and metadata. For a markdown skill description, a brief disclosure is expected when behavior can materially affect user data storage and privacy.

Static analysis

No suspicious patterns detected.