tiktok-publish
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses sensitive OAuth2 configuration and token files located at
~/.openclaw/credentials/tiktok_config.jsonand~/.openclaw/credentials/tiktok_token.json. These credentials are used to authenticate with TikTok's official API endpoints. - [DATA_EXFILTRATION]: The
publish_tiktok.pyscript transmits video data and metadata toopen.tiktokapis.com. This is the intended behavior of the skill and targets a well-known, official service domain. - [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local Python script (
publish_tiktok.py) and a shell script (record.sh) for tracking purposes. These operations are restricted to the local filesystem and the skill's own directory structure. - [DATA_EXPOSURE]: The skill utilizes sensitive file paths (credential and token storage) within the user's home directory. This follows standard CLI application patterns for managing persistent authentication states.
Audit Metadata