Skills maxhub-tiktok

📦

maxhub-tiktok

Name: maxhub-tiktok
Author: XieWxx

v3.2.0 Content revision r1 High Risk 🌐 Network access🔑 Env variables⚙️ External commands

Analyze TikTok Data With MaxHub

TikTok research often needs many video, user, search, and ad endpoints. This skill routes requests through MaxHub references and returns structured summaries.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "maxhub-tiktok" from https://skillstore.io/skills/xiewxx-maxhub-tiktok.md and its manifest at https://skillstore.io/api/skills/xiewxx-maxhub-tiktok/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/xiewxx-maxhub-tiktok.md Signed manifest GET /api/skills/xiewxx-maxhub-tiktok/manifest Signed lockfile GET /api/skills/xiewxx-maxhub-tiktok/lockfile

Test it

Using "maxhub-tiktok". Analyze creator @example for recent performance.

Expected outcome:

The report lists profile metrics, recent video themes, engagement changes, and endpoints that returned no data.

Using "maxhub-tiktok". Find TikTok ads for a skincare product in the United States.

Expected outcome:

The response groups matching ads by creative angle, visible engagement, product references, and missing regional coverage.

Using "maxhub-tiktok". Compare video search results for two keywords.

Expected outcome:

The comparison highlights result volume, common creators, engagement ranges, and which keyword has stronger current signals.

Security Audit

High Risk

v4 • 7/8/2026 Open versioned report

Most static hits are Markdown documentation false positives, including backticks, endpoint IDs, sample URLs, and bilingual text. Confirmed risk remains because the skill handles a MaxHub API key, may transmit TikTok cookies, and documents anti-abuse and interaction capabilities.

Files scanned

9,970

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (3)

High

SKILL.md:47-50 SKILL.md:67-75 references/api-user.md:165-181

Credential and Session Cookie Transmission to Third Party

The skill sends MAXHUB_API_KEY as a Bearer token to MaxHub and warns that some endpoints may require platform session cookies.

The credential header and cookie requirements are explicit in the skill and reference files. This is intentional third-party credential handling, not scanner noise.

High

references/api-video.md:7-33 references/api-video.md:3158-3185 references/api-video.md:3971-4001

Anti-Abuse Token and Guest Cookie Generation

The references include endpoints for TikTok encryption headers, guest cookies, real msToken generation, and randomized browser fingerprint data.

The documentation directly describes generating TikTok request headers, guest cookies, and randomized browser fingerprint data for crawler resistance.

High

SKILL.md:80-82 README.md:14-15 references/api-video.md:6364-6388

Read-Only Claim Conflicts With Interaction Actions

The skill claims read-only operation, but README content lists like, follow, comment, collect, and forward actions, and references include private-message deep links.

The read-only statement is explicit, while separate files advertise interaction actions and a private-message deep link. Some actions may only generate links, but the scope mismatch is real.

Capability review items (9)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/api-ads-analytics.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

High

references/api-search.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

High

references/api-user.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

High

references/api-video.md:4

Generic API/secret keys

Auth: `Authorization: Bearer $MAXHUB_API_KEY`

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

High

SKILL.md:10

Generic API/secret keys

primaryEnv: MAXHUB_API_KEY

The skill declares MAXHUB_API_KEY as a required sensitive environment value. This is expected for the API integration but grants the skill access to a secret.

High

SKILL.md:13

Generic API/secret keys

- MAXHUB_API_KEY

The skill declares MAXHUB_API_KEY as a required sensitive environment value. This is expected for the API integration but grants the skill access to a secret.

High

SKILL.md:17

Generic API/secret keys

- name: MAXHUB_API_KEY

The skill declares MAXHUB_API_KEY as a required sensitive environment value. This is expected for the API integration but grants the skill access to a secret.

High

SKILL.md:47

Generic API/secret keys

Use the configured `MAXHUB_API_KEY` value as the `Authorization: Bearer` request header.

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

High

SKILL.md:50

Generic API/secret keys

maxhub_auth_header="Authorization: Bearer ${MAXHUB_API_KEY}"

This instructs use of MAXHUB_API_KEY as a Bearer token for MaxHub API calls. The token is intentionally sent to a third-party service.

Risk Factors

🌐 Network access (64)

🔑 Env variables (16)

README_CN.md:26 README.md:26 references/api-ads-analytics.md:4 references/api-search.md:4 references/api-user.md:4 references/api-video.md:4 SKILL.md:10 SKILL.md:13 SKILL.md:17 SKILL.md:47 SKILL.md:50 SKILL.md:89 SKILL.md:101 SKILL.md:102 SKILL.md:112 SKILL.md:113

⚙️ External commands (19)

SKILL.md:45 SKILL.md:47 SKILL.md:49-61 SKILL.md:61-75 SKILL.md:75-77 SKILL.md:77-88 SKILL.md:88-90 SKILL.md:90-101 SKILL.md:101-102 SKILL.md:102-112 SKILL.md:112-113 SKILL.md:113-127 SKILL.md:127-128 SKILL.md:128-129 SKILL.md:129-130 SKILL.md:130-131 SKILL.md:131-132 SKILL.md:132-133 SKILL.md:133-192

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/xiewxx-maxhub-tiktok/security.svg)](https://skillstore.io/skills/xiewxx-maxhub-tiktok?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/xiewxx-maxhub-tiktok?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiewxx-maxhub-tiktok/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/xiewxx-maxhub-tiktok.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

XieWxx. (2026). maxhub-tiktok security audit report (audit version 4) [Author version 3.2.0]. Skillstore. https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4

BibTeX citation

@techreport{xiewxx-xiewxx-maxhub-tiktok-2026,
  author = {XieWxx},
  title = {maxhub-tiktok security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4},
  note = {Author version 3.2.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "maxhub-tiktok security audit report (audit version 4)"
version: "3.2.0"
type: report
authors:
  - name: "XieWxx"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/xiewxx-maxhub-tiktok/audits/4"
identifiers:
  - type: other
    value: "skillstore:xiewxx-maxhub-tiktok:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

100

Maintainability

Content

Community

100

Spec Compliance

What You Can Build

Profile Creator Performance

Compare creator profile data, recent posts, engagement signals, and audience metrics from MaxHub endpoints.

Research Ads and Keywords

Find TikTok ads, keyword insights, product signals, and creative patterns for campaign planning.

Map API Workflows

Translate a TikTok data question into likely MaxHub endpoints, parameters, and response expectations.

Try These Prompts

Fetch Video Details

Use maxhub-tiktok to retrieve details for this TikTok video URL: [url]. Summarize views, engagement, author, and data limits.

Analyze a Creator

Analyze TikTok creator [handle]. Find profile data, recent posts, engagement patterns, and any missing fields.

Compare Ad Examples

Compare TikTok ads for [brand or product] in [regions]. Include creative themes, engagement signals, and source limitations.

Build Market Report

Create a TikTok market report for [category] in [country]. Use search, creator, ad, and product analytics endpoints. State credential limits.

Best Practices

Use scoped or test credentials when possible.
Avoid sending full browser cookies unless the endpoint requires them.
Disclose third-party data use and verify TikTok platform compliance before automation.

Avoid

Do not provide personal session cookies for casual analysis.
Do not automate likes, follows, comments, or messages without explicit authorization.
Do not treat third-party API results as official TikTok records.

Frequently Asked Questions

Does this skill require an API key?

Yes. It requires MAXHUB_API_KEY for MaxHub API requests.

Can it work without network access?

No. The skill is designed around calls to the MaxHub API service.

Does it support English and Chinese?

Yes. The skill instructions and references support both languages.

Will it store my TikTok cookie?

The skill text says cookies are sent to MaxHub for requests. Storage behavior depends on the provider.

Is every endpoint read-only?

No evidence found that every referenced capability is read-only. Review interaction and deep-link endpoints before use.

Can Claude, Codex, or Claude Code use it?

Yes. The report declares support for Claude, Codex, and Claude Code.

Developer Details

Author

XieWxx

License

MIT-0

Author version

v3.2.0

Skillstore revision

Repository

https://github.com/XieWxx/maxhub-api-skills/tree/main/maxhub-tiktok

Ref

64ca8af0f54a325752f08bd54e52151061ea659a

Maintenance freshness

7/20/2026

Usage

7 downloads · 82 views

File structure

📁 references/

📄 api-ads-analytics.md

📄 api-search.md

📄 api-user.md

📄 api-video.md

📄 param-mappings.md

📄 _meta.json

📄 README_CN.md

📄 README.md

📄 SKILL.md

More from XieWxx

View all

📦

maxhub-toutiao

Query Toutiao Content Data

Toutiao research often requires separate lookups for articles, videos, users, and comments. This skill routes those requests through MaxHub and returns concise bilingual results.

Productivity View

📦

maxhub-hybrid

Parse Hybrid Video Content with MaxHub

Teams need a consistent way to parse public video links across supported platforms. This skill guides MaxHub HybridParser calls with clear limits and API key handling.

Data & Analytics View

📦

maxhub-lemon8

Explore Lemon8 Content Data

Lemon8 research often requires searching posts, profiles, topics, and trends across several endpoints. This skill routes requests to MaxHub APIs and returns concise discovery, comparison, and analysis results.

Research & Learning View

📦

maxhub-skills

Query Social Media Data with MaxHub

Teams need structured social media data without hand-building API calls. This skill guides Claude, Codex, and Claude Code through MaxHub API lookups across supported platforms.

Data & Analytics View

📦

maxhub-wechat

Analyze WeChat Public Data with MaxHub

Teams need reliable WeChat public data for content and account analysis. This skill queries MaxHub endpoints for Channels and Official Accounts and summarizes results.

Data & Analytics View

View all

📦

tiktok-api

Explore TikTok Data with Fetcher.sh

by fetcher-sh

Official TikTok access can require application review and does not fit quick, read-only research. This skill guides paid Fetcher.sh requests for posts, profiles, comments, and discovery feeds.

Data & Analytics View

📦

viral-tiktok-content

Create TikTok Scripts That Hold Attention

by vyralcontent

TikTok content often fails because the hook, pacing, and sound choices do not match FYP behavior. This skill gives structured hooks, scripts, checklists, and Shop video templates for platform-specific execution.

Writing & Content View

📦

youtube-channel-api-skill

Discover YouTube Channels with Structured Data

by browser-act

Finding relevant YouTube creators manually takes time and produces inconsistent records. This skill searches through BrowserAct and returns structured channel details.

Research & Learning View

📦

tiktok-automation

Automate TikTok Publishing with Rube MCP

by sickn33

Manual TikTok publishing slows teams when uploads, statuses, and privacy settings must stay consistent. This skill guides Claude, Codex, and Claude Code through Rube MCP workflows.

Communication View

📦

youtube-influencer-finder-api-skill

Find YouTube Influencers with BrowserAct

by browser-act

Finding suitable YouTube creators requires slow, repetitive profile research. This skill runs a BrowserAct workflow and returns channel metrics, links, and available contact details.

Research & Learning View

📦

exploratory-data-analysis

Analyze Scientific Data Files

by davila7

Scientific datasets often arrive in specialized formats that are hard to inspect quickly. This skill detects the format, summarizes contents, checks quality, and produces a clear EDA report.

Data & Analytics View

maxhub-tiktok

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (3)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Profile Creator Performance

Research Ads and Keywords

Map API Workflows

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details

More from XieWxx

maxhub-toutiao

maxhub-hybrid

maxhub-lemon8

maxhub-skills

maxhub-wechat

Related Skills

tiktok-api

viral-tiktok-content

youtube-channel-api-skill

tiktok-automation

youtube-influencer-finder-api-skill

exploratory-data-analysis