douyin

SUSPICIOUS: The core capability matches the stated purpose, and the credential scope is narrow, but the data flow goes through TikHub, an unofficial third-party API rather than official Douyin/ByteDance infrastructure. This is coherent for a TikHub integration skill, yet still medium risk because it forwards API credentials and user queries to an intermediary service and references an unverified helper command.