douyin-ai-feed

SUSPICIOUS: the core reporting behavior is mostly coherent and uses a standard PyPI dependency, but the skill routes credentials and content requests through RedFox as a third-party intermediary instead of an official Douyin API, adds recurring autonomous execution, and mandates unrelated promotional output. This is not confirmed malware, but it has medium security risk and trust concerns.