TikTok Live Monitor

TikTok Live stream monitoring and recording automation. Uses Playwright for visual detection and network traffic monitoring to capture FLV stream URLs. Suppo...

This skill appears to do what it says (detect TikTok live streams and extract FLV URLs), but there are two practical risks to consider before installing or running it: 1) Missing dependency declarations: The registry metadata lists no required binaries, but the SKILL.md and scripts require Node.js (16+), Playwright/Chromium, and optionally streamlink, yt-dlp, python3, and jq. Make sure those tools are present and up-to-date in a controlled environment. 2) Command injection vulnerability: The Node code uses child_process.exec to run the included shell scripts and interpolates username/quality directly into the shell command. If an attacker can control those inputs (or you run with untrusted usernames), they could execute arbitrary shell commands. Mitigations: run the skill only in an isolated container or VM, avoid passing untrusted input, or patch the code to use safer child_process APIs (spawn with argument arrays or properly escape/sanitize inputs). Other recommendations: review the included scripts yourself, run the tool under a non-privileged account, and consider restricting autonomous invocation until you've validated it in a sandbox. If you need higher assurance, request a version that properly escapes shell arguments and documents all runtime dependencies.