Profit Margin Calculator Tiktok

Security checks across static analysis, malware telemetry, and agentic risk

Overview

The skill does not show credential or network abuse, but the included calculator appears to be Amazon/FBA code under a TikTok Shop label, which could mislead business calculations.

Review this skill carefully before installing. It appears low-risk from a credential and data-access perspective, but the calculator code does not appear aligned with the advertised TikTok Shop purpose. Verify the formulas and source before using it for pricing decisions.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A seller could make pricing or margin decisions using formulas intended for a different marketplace.

Why it was flagged

The executable calculator appears to implement Amazon/FBA referral and fulfillment logic, while the skill is presented as a TikTok Shop/FBT profit margin calculator. That mismatch can cause users to trust calculations that may not match the advertised platform.

Skill content
"""Amazon Profit Calculator - Core Engine""" ... REFERRAL_FEE_RATES = { "default": 0.15, ... } ... FBA_FULFILLMENT_FEES = { ... }
Recommendation

Do not rely on the calculator until the implementation is corrected or independently verified against current TikTok Shop fee rules.

What this means

Running a global install command may add code from an external source to the user's environment.

Why it was flagged

The skill documents a user-run global install command from an external skill collection. This is expected setup-style behavior, not automatic execution, but it is still provenance-sensitive.

Skill content
npx skills add nexscope-ai/eCommerce-Skills --skill profit-margin-calculator-tiktok -g
Recommendation

Verify the repository or package source and version before running the install command, especially because the registry source is listed as unknown.