Skills maxhub-tiktok

📦

maxhub-tiktok

Name: maxhub-tiktok
Author: XieWxx

v3.2.0 Content revision r1 High Risk 🌐 Network access🔑 Env variables⚙️ External commands

Analyze TikTok Data With MaxHub

TikTok research often needs many video, user, search, and ad endpoints. This skill routes requests through MaxHub references and returns structured summaries.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "maxhub-tiktok" from https://skillstore.io/skills/xiewxx-maxhub-tiktok.md and its manifest at https://skillstore.io/api/skills/xiewxx-maxhub-tiktok/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/xiewxx-maxhub-tiktok.md Signed manifest GET /api/skills/xiewxx-maxhub-tiktok/manifest Signed lockfile GET /api/skills/xiewxx-maxhub-tiktok/lockfile

Test it

Using "maxhub-tiktok". Analyze creator @example for recent performance.

Expected outcome:

The report lists profile metrics, recent video themes, engagement changes, and endpoints that returned no data.

Using "maxhub-tiktok". Find TikTok ads for a skincare product in the United States.

Expected outcome:

The response groups matching ads by creative angle, visible engagement, product references, and missing regional coverage.

Using "maxhub-tiktok". Compare video search results for two keywords.

Expected outcome:

The comparison highlights result volume, common creators, engagement ranges, and which keyword has stronger current signals.

Security Audit

High Risk

v4 • 7/8/2026 Open versioned report

Most static hits are Markdown documentation false positives, including backticks, endpoint IDs, sample URLs, and bilingual text. Confirmed risk remains because the skill handles a MaxHub API key, may transmit TikTok cookies, and documents anti-abuse and interaction capabilities.

Files scanned

9,970

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:47-50 SKILL.md:67-75 references/api-user.md:165-181

Credential and Session Cookie Transmission to Third Party

The skill sends MAXHUB_API_KEY as a Bearer token to MaxHub and warns that some endpoints may require platform session cookies.

The credential header and cookie requirements are explicit in the skill and reference files. This is intentional third-party credential handling, not scanner noise.

High

references/api-video.md:7-33 references/api-video.md:3158-3185 references/api-video.md:3971-4001

Anti-Abuse Token and Guest Cookie Generation

The references include endpoints for TikTok encryption headers, guest cookies, real msToken generation, and randomized browser fingerprint data.

The documentation directly describes generating TikTok request headers, guest cookies, and randomized browser fingerprint data for crawler resistance.

High

SKILL.md:80-82 README.md:14-15 references/api-video.md:6364-6388

Read-Only Claim Conflicts With Interaction Actions

The skill claims read-only operation, but README content lists like, follow, comment, collect, and forward actions, and references include private-message deep links.

The read-only statement is explicit, while separate files advertise interaction actions and a private-message deep link. Some actions may only generate links, but the scope mismatch is real.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/api-ads-analytics.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

High

references/api-search.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

High

references/api-user.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

High

references/api-video.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

High

SKILL.md:10

Generic API/secret keys

primaryEnv: MAXHUB_API_KEY

The skill declares MAXHUB_API_KEY as a required sensitive environment value. This is expected for the API integration but grants the skill access to a secret.

High

SKILL.md:13

Generic API/secret keys

- MAXHUB_API_KEY

The skill declares MAXHUB_API_KEY as a required sensitive environment value. This is expected for the API integration but grants the skill access to a secret.

High

SKILL.md:17

Generic API/secret keys

- name: MAXHUB_API_KEY

The skill declares MAXHUB_API_KEY as a required sensitive environment value. This is expected for the API integration but grants the skill access to a secret.

High

SKILL.md:47

Generic API/secret keys

Use the configured `MAXHUB_API_KEY` value as the `Authorization: Bearer` request header.

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

High

SKILL.md:50

Generic API/secret keys

maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

Risk Factors

🌐 Network access (64)

🔑 Env variables (16)

README_CN.md:26 README.md:26 references/api-ads-analytics.md:4 references/api-search.md:4 references/api-user.md:4 references/api-video.md:4 SKILL.md:10 SKILL.md:13 SKILL.md:17 SKILL.md:47 SKILL.md:50 SKILL.md:89 SKILL.md:101 SKILL.md:102 SKILL.md:112 SKILL.md:113

⚙️ External commands (19)

SKILL.md:45 SKILL.md:47 SKILL.md:49-61 SKILL.md:61-75 SKILL.md:75-77 SKILL.md:77-88 SKILL.md:88-90 SKILL.md:90-101 SKILL.md:101-102 SKILL.md:102-112 SKILL.md:112-113 SKILL.md:113-127 SKILL.md:127-128 SKILL.md:128-129 SKILL.md:129-130 SKILL.md:130-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-192

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/xiewxx-maxhub-tiktok/security.svg)](https://skillstore.io/skills/xiewxx-maxhub-tiktok?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/xiewxx-maxhub-tiktok?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiewxx-maxhub-tiktok/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/xiewxx-maxhub-tiktok.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

XieWxx. (2026). maxhub-tiktok security audit report (audit version 4) [Author version 3.2.0]. Skillstore. https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4

BibTeX citation

@techreport{xiewxx-xiewxx-maxhub-tiktok-2026,
  author = {XieWxx},
  title = {maxhub-tiktok security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4},
  note = {Author version 3.2.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "maxhub-tiktok security audit report (audit version 4)"
version: "3.2.0"
type: report
authors:
  - name: "XieWxx"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4"
identifiers:
  - type: other
    value: "skillstore:xiewxx-maxhub-tiktok:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

100

Spec Compliance

What You Can Build

Profile Creator Performance

Compare creator profile data, recent posts, engagement signals, and audience metrics from MaxHub endpoints.

Research Ads and Keywords

Find TikTok ads, keyword insights, product signals, and creative patterns for campaign planning.

Map API Workflows

Translate a TikTok data question into likely MaxHub endpoints, parameters, and response expectations.

Try These Prompts

Fetch Video Details

Use maxhub-tiktok to retrieve details for this TikTok video URL: [url]. Summarize views, engagement, author, and data limits.

Analyze a Creator

Analyze TikTok creator [handle]. Find profile data, recent posts, engagement patterns, and any missing fields.

Compare Ad Examples

Compare TikTok ads for [brand or product] in [regions]. Include creative themes, engagement signals, and source limitations.

Build Market Report

Create a TikTok market report for [category] in [country]. Use search, creator, ad, and product analytics endpoints. State credential limits.

Best Practices

Use scoped or test credentials when possible.
Avoid sending full browser cookies unless the endpoint requires them.
Disclose third-party data use and verify TikTok platform compliance before automation.

Avoid

Do not provide personal session cookies for casual analysis.
Do not automate likes, follows, comments, or messages without explicit authorization.
Do not treat third-party API results as official TikTok records.