Security audit
Security checks for vulnerabilities and agentic risk
This skill is a TikTok data collector, but it needs review because it self-updates from GitHub, persists agent instructions, and uses a logged-in browser session with third-party data handling.
Install only if you are comfortable with MonsterGet using your real logged-in browser session to collect TikTok data, with CSVs downloaded locally and settings persisted under ~/.monsterget. Review or disable the auto-update behavior before use, and be aware that client rule files may be changed so future agent sessions keep loading this skill.
> **🚫 Never run `detect-browser.sh`, `check-login.sh`, or `preflight.sh`** — these are archived reference only. The user guarantees all conditions manually. The
> **🚫 Never run `detect-browser.sh`, `check-login.sh`, or `preflight.sh`** — these are archived reference only. The user guarantees all conditions manually. The
fi # ARCHIVED — pure manual flow. We never scan the disk for the extension and # never refuse based on "more than one browser detected". The user already # confirmed which browser to use (SKILL.md Step I-II); browser_pref above IS # that confirmation. #
STAGED_SKILL="$(json_val "skill" < "$SRC/VERSION.json")"
if [ -n "$STAGED_SKILL" ]; then
# Remove old scripts, copy entire tree (SKILL.md + scripts + VERSION.json + AGENTS.md + INSTALL.md)
rm -rf "$SKILL_DIR/scripts"
cp -r "$SRC/." "$SKILL_DIR/"
chmod +x "$SKILL_DIR/scripts/"*.sh 2>/dev/null || true
UPDATED=true| Script | Purpose | |--------|---------| | `update-skill.sh` | Session start — auto-update check. Compare local version against GitHub, auto-download updates. | | `choose-browser.sh <edge\|chrome>` | Save the user's browser choice (manual — no verification, saves whatever the user says). | | `run-scrape.sh <pagePath> <param> <value> [count]` | Full scrape: generate taskId, open browser, verify process, poll, download CSV. | | `set-download-dir.sh [<dir>]` | Choose where scraped CSVs are saved (persists in state). No arg = system Downloads. Ask the user once per machine. |
| Script | Purpose | |--------|---------| | `update-skill.sh` | Session start — auto-update check. Compare local version against GitHub, auto-download updates. | | `choose-browser.sh <edge\|chrome>` | Save the user's browser choice (manual — no verification, saves whatever the user says). | | `run-scrape.sh <pagePath> <param> <value> [count]` | Full scrape: generate taskId, open browser, verify process, poll, download CSV. | | `set-download-dir.sh [<dir>]` | Choose where scraped CSVs are saved (persists in state). No arg = system Downloads. Ask the user once per machine. |
```bash # Step 1 — clone and copy the runtime (once, shared by all clients) git clone https://github.com/monsterget-com/skills /tmp/mgs mkdir -p ~/.monsterget/skill cp -r /tmp/mgs/tiktok-collector/. ~/.monsterget/skill/ # Step 2 — point your client at it (pick one)
fi
if [ "$TARGET" = "tiktok" ]; then
TK="$(curl -s --max-time 10 -X POST "$BASE_URL/api/agent/login-check-target" \
-H "Content-Type: application/json" -d '{"target":"tiktok"}' 2>/dev/null)"
TK_ID="$(echo "$TK" | sed -n 's/.*"taskId":"\([^"]*\)".*/\1/p')"
[ -n "$TK_ID" ] && TASK_ID="$TK_ID"URL="$SITE_URL${PAGEPATH}?auto=1&agentTaskId=${TASK_ID}&${PARAM}=$(urlencode "$VALUE")${COUNT_ARG}"
state_set last_scrape_url "$URL"
# ---- open + verify the browser process actually started (never ask the user) ----
open_url "$URL"
STARTED=false
for _ in 1 2 3; doNo suspicious patterns detected.