tiktok-opportunity-research@1.1.1
VERIFIED· install onlyPublisher claims: "研究TikTok搜索结果、作品结构、达人数据和用户反馈，筛选值得继续验证的机会。当用户询问TikTok选题、TikTok增长、用户痛点、获取TikTok视频数据、获取博主作品、看TikTok评论、做市场调研分析、做竞品/对标账号监控或评论舆情分析使用。触发词：TikTok搜索、TikTok评论、TikTok作品、博主作品、市场调研、对标账号、TikTok竞品分析、TikTok数据分析、短视频运营、TikTok舆情监控、热点追踪、爆款挖掘、tiktok search、tiktok work、douyin comments。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-08 and scored it 93/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
<summary><b>Q：报错 `PLAN_LIMIT` / 提示包月受限？</b></summary> A：技能侧硬上限仍是 10000 条/次（按量 Token）。**包月 Token** 搜索/作品最多 30、评论最多 40，超限返回 `PLAN_LIMIT`（退出码 1），不要当网络错误同参重试。可降 `--Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.<summary><b>Q：运行报错，提示无权限 / 退出码 3？</b></summary> A：环境变量未配置或 Token 格式不对（需 16–256 位，仅字母、数字、下划线、连字符）。 ```bash # Windows set GUAIKEI_API_TOKEN=你的TOKEN # macOS / LinuFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.<summary><b>Q：会不会泄露我的 Token？</b></summary> A：Token 只从环境变量读取，不会出现在 stdout、日志文件或错误信息中。调用时会随请求头发送到数据服务 `www.guaikei.com`（这是数据获取的必要环节）。Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.