tiktok-hashtag-videos — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tiktok-hashtag-videos (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
hashtag name → challenge info + paginated video list with author, engagement, music, and video metadata
All process output to user (progress updates, process notifications) follows the user's language.
Extract the video list for a given TikTok hashtag using the /api/challenge/item_list/ endpoint triggered by page navigation.
https://www.tiktok.comIf browser-act has been confirmed available in the current session → skip this step.
Invoke browser-act via Skill tool to load usage. If installation or configuration issues arise, follow its guidance to resolve then retry.
This Skill's operational boundary = what the user can manually do in their browser. It only reads data already displayed to the user on the page, never bypassing authentication or access controls. JS code is encapsulated in Python files under thescripts/directory, invoked viaeval "$(python scripts/xxx.py {params})".$(...)is bash syntax; it is recommended to use the bash tool for execution.
Below are all atomic capabilities discovered and verified during the exploration phase. Simply invoke them as needed — no need to read scripts/*.py source code or re-verify.
eval "$(python scripts/get-challenge-id.py '{hashtag}')"
Parameters:
{hashtag}: hashtag name without #, e.g., fitnessOutput example:
{
"id": "9261", // challengeID — required for item_list requests
"title": "fitness", // canonical hashtag title
"videoCount": "63107035", // total videos under this hashtag
"viewCount": "760591731095" // total views
}/api/challenge/item_list/ requires TikTok's dynamic signing (X-Bogus/X-Gnarly); direct fetch returns empty. Navigate to the hashtag page — TikTok's JS triggers the signed request automatically:
navigate https://www.tiktok.com/tag/{hashtag}wait stablenetwork requests --type xhr,fetch --filter "challenge/item_list"network request <id>Endpoint characteristic: URL contains /api/challenge/item_list/ with cursor=0
Error handling: If no matching request is found after navigation, take a screenshot to confirm the page loaded correctly, then retry navigation once. If the page shows a region-restriction notice, switch to a browser with a non-HK proxy.
Output example:
{
"cursor": "30", // use as cursor value to identify next page's request
"hasMore": true, // false when all pages exhausted
"itemList": [
{
"id": "7212410220977392938",
"desc": "Daily Push Up Workout🚀#fitness #athlete",
"createTime": 1679270124,
"isAd": false,
"isPinned": false,
"locationCreated": "US",
"author": {
"uniqueId": "marcusriosofficial", // username for webVideoUrl
"nickname": "Marcus Rios",
"verified": false,
"signature": "Former NFL Athlete 🏈",
"bioLink": null,
"avatarThumb": "https://...",
"privateAccount": false
},
"authorStats": {
"followerCount": 423500,
"followingCount": 50,
"heart": 10000000,
"videoCount": 1277,
"diggCount": 869
},
"stats": {
"diggCount": 367500,
"shareCount": 6041,
"playCount": 4500000,
"commentCount": 942,
"collectCount": 56691
},
"video": {
"duration": 48,
"height": 1280,
"width": 720,
"cover": "https://...",
"definition": "720p",
"format": "mp4"
},
"music": {
"id": "7176546707423889410",
"title": "Trap Money so Big (Remix)",
"authorName": "Iqbal12",
"original": false,
"coverMedium": "https://..."
},
"textExtra": [{"hashtagId": "9261", "hashtagName": "fitness"}],
"effectStickers": [],
"imagePost": null // non-null for slideshow posts
}
]
}After reading page 1, scroll down to trigger the next page request:
scroll downwait stablenetwork requests --type xhr,fetch --filter "challenge/item_list"cursor value higher than the previous page (e.g., cursor=30, cursor=60)network request <id>Termination: hasMore is false in response, or itemList is empty.
eval "$(python scripts/get-challenge-id.py '{hashtag}')" → record id as challengeId (confirms hashtag exists)navigate https://www.tiktok.com/tag/{hashtag} → wait stablenetwork requests --filter "challenge/item_list" → network request <id> → collect itemList, note cursor and hasMorehasMore is true:a. scroll down → wait stable b. network requests --filter "challenge/item_list" → find new request (cursor changed) → network request <id> c. Collect itemList, update hasMore
itemList arraysDOM Pagination: Scroll triggers new challenge/item_list requests. Each page returns 30 items. Cursor advances numerically (0 → 30 → 60...). Termination: hasMore === false or empty itemList.
itemList.length >= 1 and first item has non-null id, stats.playCount, author.uniqueId
challenge/item_list requires dynamic signing — always use navigate + network captureget-challenge-id.py (challenge/detail) works via direct fetch without signingitemListPath: {working-directory}/browser-act-skill-forge-memories/tiktok-scraper-tiktok-hashtag-videos.memory.md
Before execution: If the file exists, read it first — it records unexpected situations from past executions; adjust strategy accordingly.
After execution: If an unexpected situation occurs (strategy failed, page redesigned, anti-scraping upgraded, better path found), append a line: {YYYY-MM-DD}: {what happened} → {conclusion}
Normal execution does not write to the file.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.