tiktok-search

SUSPICIOUS. The skill's core purpose is coherent, but it reads a raw local credential file, exports the token, and routes all requests through a Gooseworks proxy instead of directly to the named service APIs. Install trust is mostly same-org and documented, so this is not confirmed malware, but the credential handling and indirect data flow are broader than necessary for a TikTok search skill.