ClawHub

TikTok Made Me Buy It

v1.0.1

Discover TikTok natural traffic videos and organic product-picking signals with PipiAds natural video search tools.

⭐ 0· 47·0 current·0 all-time
by@fanyanggod
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description match the declared requirements: the skill calls a PipiAds MCP server and requires an API key and npm to install that helper. Requesting PIPIADS_API_KEY and npm is proportionate to a PipiAds integration.
✓
Instruction Scope
SKILL.md instructs the agent to use search_natural_videos and to set PIPIADS_API_KEY. It does not ask the agent to read unrelated files, other env vars, or exfiltrate data to unexpected endpoints. The mcpServers entry runs a local pipiads-mcp-server binary with only the declared API key in its env.
ℹ
Install Mechanism
The skill's install is an npm -g install of pipiads-mcp-server@1.0.3. Global npm installs write binaries to disk and run with the user's privileges; this is a reasonable mechanism for a CLI MCP server but carries the usual risks of installing third‑party npm packages (verify publisher, inspect the package if concerned).
✓
Credentials
Only PIPIADS_API_KEY is required and declared as the primary credential. That is expected and proportionate for accessing PipiAds APIs. No unrelated secrets or config paths are requested.
✓
Persistence & Privilege
The skill is not marked always:true and does not request persistent system-wide privileges beyond installing a global npm package. It does define an MCP server command to run locally, which is consistent with its purpose and not unusually privileged.
Assessment
This skill appears coherent but exercise normal caution before installing the global npm package: verify the npm package author and repository (pipiads-mcp-server@1.0.3), prefer inspecting the package source or installing it in a sandbox, and ensure your PIPIADS_API_KEY has only the permissions needed and your PipiAds account billing/usage is acceptable. If you prefer less system impact, consider asking the maintainer for a non-global or containerized install option.

Like a lobster shell, security has layers — review code before you run it.

latestvk97f560m8qq353nzry2a92xn1x8421vs

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📊 Clawdis
Binsnpm
EnvPIPIADS_API_KEY
Primary envPIPIADS_API_KEY

Comments