Tiktok Trend Challenger
v0.1.0Hire TikTok creators to participate in trending hashtags, viral challenges, and cultural moments to boost brand visibility and algorithmic reach on the For Y...
⭐ 1· 1k·6 current·6 all-time
byYuPeng Wu@realroc
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name, description, and examples all describe hiring/working with TikTok creators and show API calls to pinghuman.ai for listing creators and posting tasks. The skill does not request unrelated binaries, cloud credentials, or services outside that scope.
Instruction Scope
SKILL.md instructs the agent to call pinghuman.ai APIs and to add the skill URL to ~/.agent/skills.txt. Referencing the agent config path (~/.agent/skills.txt) is reasonable for installation but that path was not declared in the registry metadata. The docs also show example Authorization: Bearer headers, but do not describe how tokens are obtained or stored — sensible but an omission to be aware of.
Install Mechanism
There is no install spec and no code files — the skill is instruction-only. That minimizes disk-write/install risk; it relies on network calls to the documented API base (https://www.pinghuman.ai/api/v1).
Credentials
Registry declares no required environment variables or credentials, yet the examples use a Bearer API token (ph_sk_abc123...). Requiring an API token for the PingHuman service is proportional to the skill's function, but the metadata does not explicitly surface that requirement (no primary credential listed).
Persistence & Privilege
always is false and the skill is user-invocable. The only persistence-related action in the docs is appending the skill URL to ~/.agent/skills.txt (agent config), which is normal for adding a skill but was not listed in declared config paths.
Assessment
This skill is instruction-only and appears to do what it says: it makes API calls to pinghuman.ai to find/hire TikTok creators. Before installing, confirm you trust pinghuman.ai and are comfortable providing an API Bearer token (the docs show Authorization headers) — the skill metadata does not list that credential but the API examples require it. Note the install example writes to ~/.agent/skills.txt; ensure you are okay with adding the remote skill URL to your agent config. Avoid supplying unrelated secrets (AWS keys, system passwords). If you need higher assurance, ask the publisher for explicit docs about how API tokens are obtained/stored and for a published privacy/terms page describing how creator and campaign data are used.Like a lobster shell, security has layers — review code before you run it.
latestvk9798y08tdftvh4m20r2gkzj9x8193z4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.