tiktok-downloader

Download TikTok videos by URL or hashtag. Handles 403 errors, cookies, and user-agent rotation. Use for downloading TikTok videos, batch downloading from a l...

This skill appears to do what it says, but it asks the agent to read your browser cookie directory (a sensitive source of session tokens) and assumes yt-dlp and a Chromium profile exist even though those are not declared. Before installing: 1) Inspect the script yourself (it's short) to confirm no network exfiltration — the included script does not POST to external endpoints. 2) Avoid giving it unrestricted access to your real browser profile; instead create a dedicated browser profile with only TikTok cookies or run in an isolated/VM environment. 3) Ensure yt-dlp is installed from a trusted source if you intend to use the skill. 4) Ask the publisher to declare required binaries and the config path in metadata, or remove hardcoded absolute paths so you can control which cookie store is used.

Type: OpenClaw Skill Name: tiktok-downloader Version: 1.0.0 The skill is classified as suspicious because it requires access to sensitive browser profile data (`/home/ubuntu/.browser_data_dir`) to extract cookies for bypassing TikTok's anti-bot measures, as documented in `SKILL.md`. While this functionality is aligned with the stated purpose, the `scripts/download_tiktok.sh` script is vulnerable to argument injection because it passes the user-provided URL directly to `yt-dlp` without using the `--` separator, which could allow an attacker to execute arbitrary commands via `yt-dlp` flags (e.g., `--exec`).