tiktok-shop-product-scraper

SUSPICIOUS. The stated scraping purpose is coherent, and the named dependency appears to be an official same-org tool rather than an obvious credential harvester. The main concern is transitive trust plus automatic dependency installation without user confirmation, which is disproportionate for a thin wrapper skill that delegates nearly all execution to another skill/CLI.