douyin-content-surge

SUSPICIOUS. The skill is narrowly scoped and does not use risky installers or extra binaries, but it routes credentials and data through doubaoya.com instead of Douyin's official API domain, and public verification of that endpoint relationship was not established. This looks more like third-party API mediation risk than confirmed malware.