tiktok-slideshow

SUSPICIOUS: the visible orchestrator is mostly coherent for local TikTok content production and has good human gates, but it extends trust to several unseen sub-skills and a skill updater, and it can execute registry-sourced tooling via bunx without pinning. No direct credential theft or exfiltration is shown, so this is better classified as medium supply-chain and transitive-trust risk rather than malware.