tikhub-api-skill

Search and query TikHub APIs for TikTok, Douyin, Xiaohongshu, Lemon8, Instagram, YouTube, Twitter, Reddit, and more. Use when user asks about needs to fetch...

What to consider before installing: - Do not assume the embedded DEFAULT_TOKEN is safe: api_client.py contains a hard-coded token which will be used if you don't supply your own — this can mean actions run under someone else's account or incur charges. Replace or remove the DEFAULT_TOKEN and use your own TIKHUB_TOKEN. - SKILL.md recommends setting TIKHUB_TOKEN, but the CLI does not read that environment variable; confirm the implementation will use your token (or modify the code to read os.environ['TIKHUB_TOKEN']). Ask the author to fix this mismatch. - The README contains prompt-injection-like patterns (base64 and unicode control characters). Open SKILL.md in a plain text editor, search for non-printable characters or encoded blocks, and remove/verify anything suspicious. - Review openapi.json (it's large) to ensure it doesn't contain unexpected endpoints or sensitive-sounding functionality you don't want (e.g., services that bypass captchas or send emails). - If you plan to use the API, create and use your own TikHub API key from your account (do not rely on the shipped DEFAULT_TOKEN). - When in doubt, ask the publisher for provenance (who published this skill) and for a version that does not include hard-coded credentials or hidden characters. - If you cannot validate these points, avoid running the packaged scripts against the network or sanitize the code first (remove DEFAULT_TOKEN, add explicit env-var reading, and remove suspicious characters).

Type: OpenClaw Skill Name: tikhub-api-skill Version: 1.0.0 The TikHub API skill bundle is a legitimate tool designed to help users search and interact with social media data APIs. The code consists of a search utility (api_searcher.py) for exploring API endpoints and a client (api_client.py) for making HTTP requests to the TikHub service. It uses standard Python libraries, includes clear documentation for the AI agent, and lacks any indicators of malicious intent, data exfiltration, or unauthorized execution. The inclusion of a default development token and specific path-handling logic for Windows environments are functional features aligned with the stated purpose of the skill.