tiktok — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tiktok (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
End-to-end skill for publishing organic content to TikTok through the TikTok Content Sharing Guidelines-compliant interactive posting form.
| Request | Send them to |
|---|---|
| TikTok ad campaign, Spark Ads, paid promotion | tiktok-ads |
| Instagram post / Reel / story | instagram |
| LinkedIn document or carousel post | linkedin |
If search("tiktok_post_form_open") does not find tiktok_post_form_open, stop and tell the user to enable Hyper MCP and connect TikTok.
Every tool in this skill is named by its canonical tool name. Run it with the call your surface gives you:
| Surface | Find a tool | Run it |
|---|---|---|
| MCP client (Claude, Cursor, Codex, ChatGPT) | search("<what you want to do>"), then describe("<name>") | call("<name>", {...}) |
| Hyper CLI | hyperai search "<what you want to do>", then hyperai describe <name> | hyperai call <name> --json '{...}' |
If a tool is not found, its integration is not connected or not enabled for the workspace: stop and tell the user which integration to connect.
| Tool | Purpose |
|---|---|
tiktok_post_form_open | The only entrypoint when a user wants to post. Opens the compliance form. |
tiktok_videos_send_from_url, tiktok_post_video_from_file, tiktok_photos_send | Final posting tools — call ONLY after the user submits the form. |
tiktok_current_user_get | Authenticated user profile (does not require the form). |
tiktok_creator_info_get | Check posting capabilities and limits. |
tiktok_videos_list, tiktok_videos_query | Browse the user's published videos. |
tiktok_posts_status_get | Check the status of a previously submitted post. |
tiktok_videos_upload_from_url, tiktok_videos_upload_from_file, tiktok_photos_upload | Send to inbox as draft (user posts manually in the TikTok app — bypasses the form intentionally). |
CRITICAL: ALWAYS usetiktok_post_form_openwhen a user wants to post to TikTok. NEVER calltiktok_videos_send_from_url,tiktok_photos_send, ortiktok_post_video_from_filedirectly in response to a user request. The posting form is required for TikTok compliance.
CRITICAL: Do NOT ask the user about privacy, policies, captions, or branded content settings before opening the form. The form handles all of this interactively.
CRITICAL: Call tiktok_post_form_open immediately when the user wants to post. Do not gather information first.If the user says ANY of:
Immediately call `tiktok_post_form_open`:
tiktok_post_form_open(
media_type="video", # or "photo"
media_url="<url>", # single video / single photo URL
media_urls=["<url>", ...] # for photo carousels (max 35)
)DO NOT:
tiktok_videos_send_from_url or tiktok_photos_send directly.The interactive posting form is TikTok Content Sharing Guidelines compliant and handles:
#hashtags and @mentions).When calling tiktok_post_form_open, provide what you know:
| Parameter | When to provide |
|---|---|
media_type | Always ("video" or "photo"). |
media_url | Single video or single photo. |
media_urls | Photo carousel (list of URLs, max 35). |
video_duration_sec | If known — enables duration validation. |
title | If the user mentioned a caption. |
is_aigc | If you generated the media (Veo, Seedance, image gen, etc.). |
When the user fills out and submits the form, you receive a message containing all their chosen settings. At that point, call the appropriate posting tool with the exact parameters from their submission:
tiktok_videos_send_from_urltiktok_post_video_from_filetiktok_photos_sendThe posting tool will automatically poll status and return a completion message.
Videos:
Photos:
Domain verification:
tiktok_post_form_open(media_type="video", media_url="<url>").tiktok_videos_send_from_url(...) with the submitted parameters.These tools intentionally bypass the form — they send content to the user's TikTok app for manual posting:
tiktok_videos_upload_from_url — send video to inbox as draft.tiktok_videos_upload_from_file — upload file to inbox as draft.tiktok_photos_upload — send photos to inbox as draft.Use these only when the user explicitly asks to "send to my TikTok drafts" or "I want to post manually in the app". Otherwise, default to the form path.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.