tiktok-content-posting
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns detected. The skill implements strong security controls, including a 'confirm-plan' mechanism that prevents accidental execution and ensures the user reviews the exact content and destination before posting.
- [COMMAND_EXECUTION]: The script executes
ffprobeto validate media file specifications (codec, dimensions, duration). This is a functional requirement and is performed securely usingspawnSyncwith limited arguments to prevent command injection. - [EXTERNAL_DOWNLOADS]: The skill interacts with the official TikTok API at
https://open.tiktokapis.comand downloads media from user-specified HTTPS URLs. These operations are essential for the skill's purpose and are conducted over secure protocols. - [CREDENTIALS_UNSAFE]: The skill correctly manages credentials by reading the
TIKTOK_ACCESS_TOKENfrom environment variables, explicitly forbidding tokens in command-line arguments to prevent leakage in process lists or shell history. It also includes redaction logic to ensure secrets do not appear in output or logs.
Audit Metadata