TikTok Crawling (yt-dlp)
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent or a scheduled job could act as your logged-in TikTok session and download content your account can access.
This directs use of local Chrome browser cookies to access authenticated/private or restricted TikTok content. The artifact does not add an approval boundary, dedicated-profile guidance, or clear scoping for the session material.
### Authentication (Private/Restricted Content) ... # Use cookies from browser (recommended) yt-dlp --cookies-from-browser chrome "https://www.tiktok.com/@handle"
Do not allow automatic use of browser cookies. If authentication is needed, use a dedicated browser profile/account or an explicit cookie file for the intended TikTok scope, and delete it when done.
Your account, IP address, or network setup could be used in ways you did not intend while scraping.
The troubleshooting guidance treats platform rate and region limits as conditions to work around with cookies, different IPs, VPN, or geo-bypass. This is disclosed and related to scraping, but it is a sensitive use pattern that should remain user-controlled.
Empty results / no videos found | Add `--cookies-from-browser chrome` — TikTok rate-limits anonymous requests ... 403 Forbidden errors | Rate limited. Wait 10-15 min, or use cookies/different IP ... Region-locked. Try `--geo-bypass` or a VPN
Keep scraping scoped to content you are authorized to access, and require explicit user approval before using cookies, VPN, different-IP, or geo-bypass options.
If enabled, downloads may continue in the background and may keep using your browser-authenticated TikTok session.
The cron example creates ongoing daily execution and the sample script uses browser cookies. It is disclosed and user-directed, but it can keep operating after the initial setup.
### Scheduled Scraping (Cron) ... 0 2 * * * cd /path/to/project && ./scripts/scrape-tiktok.sh >> ./tiktok/logs/cron.log 2>&1 ... --cookies-from-browser chrome
Only create the cron job if you want ongoing scraping, document how to disable it, and avoid browser-cookie use in scheduled jobs unless strictly needed.
You must trust and maintain the locally installed yt-dlp/ffmpeg packages yourself.
The skill relies on external executable dependencies installed from package managers, but the registry has no install spec or pinned versions. This is expected for a yt-dlp guide but leaves verification to the user.
# macOS brew install yt-dlp ffmpeg ... # pip (any platform) pip install yt-dlp
Install from trusted package sources, verify versions, and consider pinning or documenting known-good versions before using the skill.