tiktok-subscribe

SUSPICIOUS. The skill is largely coherent with its stated TikTok monitoring purpose and sends data directly to the publisher-linked RedFox API, but it expands credential scope by reading shell config files, weakens TLS hostname verification, and can autonomously schedule recurring actions. No clear malware, hidden exfiltration endpoint, or unverifiable binary install was found.