Security audit
Security checks for vulnerabilities and agentic risk
The skill is rated benign with medium confidence, but the review is incomplete: scanners report a mismatch between its advertised batch video downloads and stated exclusions, and several scripts could not be fully interpreted.
Before installing, consider whether the conflicting description matches what you need. The verdict is benign, but confidence is medium and the scan was partial: only 20 of 32 components were fully inspected, so some script behavior remains unassessed.
Referenced artifact was not completely inspected
- "帮我搜 TikTok 上 AI 点赞最多的视频 → node scripts/tiktok/search-cli.js --keyword \"AI\" --sort 1 --limit 20"
Referenced artifact was not completely inspected
- "最近一周 TikTok 的 AI model，要 20 条 → node scripts/tiktok/search-cli.js --keyword \"AI model\" --time 7 --limit 20"
Referenced artifact was not completely inspected
| 找选题、看高赞 | `search-cli.js` | 视频数组。点赞、播放、评论是数字 |
Referenced artifact was not completely inspected
3. 有关键词，且没有上面两类信号 → `search-cli.js`
Referenced artifact was not completely inspected
0，stdout 为空。短参数大小写都可以。含空格的关键词用双引号包成一个参数。关键词以 `-` 开头时写成 `--keyword=-AI`，或 `node scripts/tiktok/search-cli.js -- -AI`。完整字段见 `assets/*_cli_req.schema.json` 与 [ref
Referenced artifact was not completely inspected
- "这个 TikTok 博主最近 30 条作品 → node scripts/tiktok/post-cli.js --url \"https://www.tiktok.com/@username\" --sort 0 --limit 30"
Referenced artifact was not completely inspected
- "这个 TikTok 博主什么最火 → node scripts/tiktok/post-cli.js --url \"https://www.tiktok.com/@username\" --sort 1 --limit 30"
Referenced artifact was not completely inspected
- "盯一下这个竞品账号最近发了什么 → node scripts/tiktok/post-cli.js --url \"https://www.tiktok.com/@competitor\" --limit 10"
Referenced artifact was not completely inspected
| 看博主作品 | `post-cli.js` | 作品数组。没有单独的粉丝总数对象 |
Referenced artifact was not completely inspected
2. 要作品、主页、账号、博主、达人 → `post-cli.js`
Referenced artifact was not completely inspected
- `tiktok.com/@用户名` 只能给 `post-cli.js`。`http`、缺 `www`、`m.tiktok.com` 会在本地改成 `https://www.tiktok.com/@用户名`
Referenced artifact was not completely inspected
- 整段 `MS4w` 开头的 `sec_uid` 只能给 `post-cli.js`。搜索结果用 `author_sec_uid`，或 `author_url`
Referenced artifact was not completely inspected
- "这条 TikTok 视频评论区在说什么，帮我归纳舆情 → node scripts/tiktok/comment-cli.js --url \"https://www.tiktok.com/@username/video/1234567890123456789\" --limit 40"
Referenced artifact was not completely inspected
| 看评论区 | `comment-cli.js` | 评论数组 |
Referenced artifact was not completely inspected
1. 要评论、留言、舆情，且对象是一条视频 → `comment-cli.js`
Referenced artifact was not completely inspected
- `tiktok.com/@用户名/video/数字` 和纯数字 `aweme_id` 只能给 `comment-cli.js`。搜索或作品结果用 `aweme_id`
Referenced artifact was not completely inspected
| 评论区 | `comment-cli.js`。没说条数用默认 10 |
Without declared permissions the skill's intent is opaque and cannot be validated.
SKILL.md L003 advertises one-click batch downloading to local storage. However, L130 states that the skill does not download videos, L152 excludes file-download requests, and L261 reiterates that video files are not downloaded. This is a substantive mismatch in the advertised capability, not an implementation detail of retrieving video metadata or playback URLs.
The comments explicitly require fixed Beijing time and conversion of API creation timestamps to that timezone. Although the constraint is documented, no regional requirement justifies it and no user-selectable timezone is offered.