Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Supply Chain Optimization Tiktok

v0.1.0

Supply Chain Bottleneck Analyzer for TikTok Shop sellers. Diagnose cash flow, inventory turnover, affiliate commissions, and return rates. Includes FBT cost...

0· 101·0 current·0 all-time
byHenk Nie@phheng

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for phheng/supply-chain-optimization-tiktok.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Supply Chain Optimization Tiktok" (phheng/supply-chain-optimization-tiktok) from ClawHub.
Skill page: https://clawhub.ai/phheng/supply-chain-optimization-tiktok
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install supply-chain-optimization-tiktok

ClawHub CLI

Package manager switcher

npx clawhub@latest install supply-chain-optimization-tiktok
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description match the included calculator code: both focus on supply-chain metrics for TikTok Shop. The SKILL.md documents optional TikTok API integration (shows env var names) but the skill metadata does not require any credentials; that is plausible for a tool that can run in 'manual input' mode, but it is an inconsistency worth noting because the docs imply capability that may only work if you run external code or provide credentials.
Instruction Scope
SKILL.md stays on-topic (metrics, benchmarks, inputs). It does reference TikTok API endpoints and example env vars, but the runtime instructions do not direct the agent to read unrelated system files or exfiltrate data. However, the docs instruct users to run an npx command to add 'nexscope-ai/eCommerce-Skills', which would fetch external code; that step is outside this skill bundle and could implicitly expand what runs on the host.
Install Mechanism
There is no explicit install spec in the bundle (instruction-only), and the included scripts/calculator.py appears to be local calculation code with no obvious network calls in the visible portion. The SKILL.md's suggested npx install command (npx skills add nexscope-ai/eCommerce-Skills) would pull code from npm when executed by a user — that's a separate risk to review before running.
Credentials
The skill metadata requires no environment variables or credentials, which aligns with a manual/calculator mode. SKILL.md, however, shows example TikTok credentials (TIKTOK_APP_KEY, TIKTOK_APP_SECRET, TIKTOK_ACCESS_TOKEN) for API integration; requiring such credentials would be expected only if you actually connect to TikTok. Because the bundle doesn't declare or automatically use them, be careful not to paste credentials into unknown or external installers.
Persistence & Privilege
The skill does not request always:true, does not claim to modify other skills, and there is no install spec that writes to system locations. It appears to run as-needed without elevated persistence.
What to consider before installing
This skill appears to be a local calculator for TikTok Shop metrics (the included Python script does calculation work), but the README suggests installing an external npm package and shows TikTok API credentials as optional inputs. Before installing or running anything: 1) Verify the publisher/source for 'nexscope-ai/eCommerce-Skills' — don't run the npx command unless you trust that package. 2) Inspect the full scripts/calculator.py and any code pulled by the npx package for network calls, credential use, or unexpected behavior. 3) Never paste TikTok (or other) API keys into a tool unless you trust its code and origin; consider using test/limited-permission keys. 4) Run the code in a sandbox or isolated environment first. If you want, provide the full (untruncated) calculator.py or confirm whether this skill will ever call out to remote APIs automatically — that would change the assessment.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e8qt6bgdfm0wre055kc4w5s83ckyv
101downloads
0stars
1versions
Updated 1mo ago
v0.1.0
MIT-0

Supply Chain Optimization — TikTok Shop 📦

Supply chain bottleneck analyzer for TikTok Shop sellers. Diagnose cash flow, inventory, affiliate costs, and return rates.

Installation

npx skills add nexscope-ai/eCommerce-Skills --skill supply-chain-optimization-tiktok -g

Platform Characteristics

FeatureTikTok Shopvs Amazon
FulfillmentFBT / Self-shipFBA
Commission2-8% (category) + 2% transaction8-15%
Payment cycle7-15 days14 days
Traffic sourceContent-drivenSearch-driven
Return rateHigher (impulse buying)Medium

Cost Structure (TikTok Shop)

Selling Price $XX
├── Product Cost
├── Inbound Shipping
├── FBT Fulfillment / Self-ship
├── Platform Fee (2%)
├── Referral Fee (2-8%)
├── Affiliate Commission (10-30%)  ← TikTok-specific
├── Advertising (Spark Ads)
└── Net Profit

Benchmark Configuration

BENCHMARKS = {
    "tiktok": {
        "gross_margin": {
            "healthy": 0.45,    # Need to cover affiliate commission
            "warning": 0.35,
            "danger": 0.25
        },
        "shipping_ratio": {
            "healthy": 0.05,
            "warning": 0.08,
            "danger": 0.12
        },
        "inventory_days": {
            "healthy": 30,      # TikTok viral cycle is short
            "warning": 45,
            "danger": 60
        },
        "cash_cycle": {
            "healthy": 60,      # Fast payment
            "warning": 90,
            "danger": 120
        },
        "net_margin": {
            "healthy": 0.15,    # After affiliate split
            "warning": 0.08,
            "danger": 0.03
        },
        # TikTok-specific metrics
        "return_rate": {
            "healthy": 0.10,    # <10% healthy
            "warning": 0.20,
            "danger": 0.30
        },
        "affiliate_ratio": {
            "healthy": 0.20,    # Affiliate commission ratio
            "warning": 0.30,
            "danger": 0.40
        }
    }
}

TikTok-Specific Costs

Affiliate Commission

Livestream selling: 10-30% commission
Short video promotion: 10-25% commission
Top influencers: May require upfront fees

Return Costs

TikTok return rates typically higher than traditional e-commerce (impulse buying)
Must account for:
├── Return shipping cost
├── Product damage/loss
└── Restocking fees

Input Data

**Sales (TikTok-specific)**
• Average Selling Price: $___
• FBT Fulfillment Fee: $___/unit
• Platform Fee: 2% (fixed)
• Referral Fee: ___%
• Affiliate Commission Rate: ___% (if applicable)
• Spark Ads Spend Ratio: ___%

**Risk (TikTok-specific)**
• Return Rate: ___%
• Return Processing Cost: $___/unit

API Integration

TikTok Shop API

export TIKTOK_APP_KEY="xxx"
export TIKTOK_APP_SECRET="xxx"
export TIKTOK_ACCESS_TOKEN="xxx"

Available Data

DataAPI
OrdersOrder API
ProductsProduct API
LogisticsLogistics API
AffiliatesAffiliate API

Bottleneck Diagnosis Focus

TikTok Shop-specific bottlenecks:

  1. High affiliate commission → Profit erosion
  2. High return rate → Hidden costs
  3. Slow inventory turnover → Short viral cycle, high stagnation risk
  4. Content dependency → Unstable traffic

vs Amazon Comparison

ItemAmazonTikTok
Commission8-15%4-10%
Affiliate splitNone10-30%
Payment cycle14 days7-15 days
Return rate5-15%10-30%
TrafficStableVolatile
Viral cycleLongShort

Part of Nexscope AI — AI tools for e-commerce sellers.

Comments

Loading comments...