tiktok-content-posting
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious code, obfuscation, or unauthorized access patterns were detected. The skill is designed with a focus on user consent and data integrity.
- [COMMAND_EXECUTION]: The bundled script
scripts/tiktok-post.mjssafely executes theffprobeutility to validate media specifications. The command is invoked with a static argument list and a restricted environment path to prevent command injection. - [EXTERNAL_DOWNLOADS]: The skill communicates with the official TikTok API at
https://open.tiktokapis.comand supports media pulls from user-defined HTTPS URLs. These network requests are essential for the skill's functionality and are protected by strict URL validation and user-approval workflows. - [CREDENTIALS_UNSAFE]: The skill implements secure credential management by requiring TikTok access tokens to be provided via environment variables rather than command-line arguments. It also includes a robust sanitization system that redacts Bearer tokens, client secrets, and sensitive query parameters from all terminal output and error messages.
Audit Metadata