ClawHub
Back to skill

Security audit

Profit Margin Calculator Tiktok

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a local calculator, but it is advertised for TikTok Shop while the shipped code calculates Amazon/FBA-style profitability.

Review before installing or relying on this skill. The main concern is not malware-like behavior; it is that TikTok Shop sellers may receive plausible-looking Amazon/FBA profitability numbers and make pricing or inventory decisions from the wrong marketplace model. Use only after the publisher aligns the documentation, formulas, inputs, and report labels to one clearly stated platform.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
86% confidence
Finding
The skill is presented as a TikTok Shop calculator, but the finding indicates underlying behavior includes Amazon-specific fee logic, FBA/storage modeling, CSV batch processing, and Amazon-branded output that are not disclosed in the SKILL.md. This is a supply-chain trust and integrity issue: users may run the skill expecting TikTok-only local calculations, while hidden or mismatched functionality can produce misleading business decisions and expand the attack surface beyond the stated purpose.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The file advertises and implements Amazon/FBA-specific logic while the skill metadata claims it is a TikTok Shop margin calculator. This is a genuine integrity and trust issue because users may rely on materially wrong fee models and business assumptions, producing incorrect profitability decisions. In a commerce-focused skill, mismatched platform logic is more dangerous because outputs appear authoritative and may directly influence pricing and inventory choices.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The comments and docstrings explicitly describe Amazon referral-fee behavior even though the published skill is presented as TikTok Shop-focused. This inconsistency is a real vulnerability in the sense of deceptive or unsafe functionality: maintainers and users can misunderstand what platform economics are being modeled, leading to systematic miscalculation. Because the skill is positioned as a no-API calculator, users are likely to trust the embedded business logic without external verification.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The generated user-facing report labels the output as an Amazon Profit Analysis Report, directly contradicting the skill's TikTok Shop description. This is a true vulnerability because the misleading output can cause end users to overlook that the calculator is using the wrong marketplace model, undermining informed decision-making. The context increases risk since sellers may act on these reports for pricing, ad spend, and return-rate planning.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.