tiktok-app-marketing

SUSPICIOUS: the skill’s capabilities broadly match its stated marketing purpose, and its main APIs/domains are purpose-aligned, but it enables high-impact public posting automation, asks for multiple sensitive platform/revenue credentials, and extends trust transitively by instructing installation of another skill. This looks more like a risky growth-automation skill than malware, with the main concerns being autonomy abuse and medium supply-chain trust rather than hidden exfiltration.