tiktok-crawling

SUSPICIOUS: the visible footprint is small, but the skill is installed through a mutable `npx` command and a transitive third-party skill source, with limited transparency about what gets installed. No direct credential theft or malicious behavior is shown, but install trust and provenance are only partially verifiable.