Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

tw fashion social manager

v1.0.7

台灣服飾品牌的社群媒體與 Meta 廣告策略專家。基於 47,000+ 則真實廣告數據,協助規劃貼文內容、廣告文案、標籤組合、發佈時間、三層漏斗策略與台灣在地化行銷。當使用者提到任何下列需求時,都應主動使用此 skill:寫貼文、寫廣告文案、規劃社群內容、選標籤、排發佈時間、設計廣告漏斗、Meta/IG/FB/T...

0· 190·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for shangweilin7/tw-fashion-social-manager.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "tw fashion social manager" (shangweilin7/tw-fashion-social-manager) from ClawHub.
Skill page: https://clawhub.ai/shangweilin7/tw-fashion-social-manager
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install tw-fashion-social-manager

ClawHub CLI

Package manager switcher

npx clawhub@latest install tw-fashion-social-manager
Security Scan
Capability signals
Requires OAuth tokenRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill is a Taiwan fashion social/ads manager and includes a Python script that calls the Facebook/Meta Graph API to fetch IG/FB/Threads insights — requiring Meta credentials (access token, client id/secret, page/IG IDs) is coherent with the stated purpose. However, the skill metadata and registry list no required environment variables or primary credential despite the script depending on multiple META_* secrets. This mismatch is a packaging/information integrity issue.
!
Instruction Scope
SKILL.md instructs running the included fetch_insights.py and installing Python packages (requests, pandas, openpyxl) — which is expected. But the execution example exports META_ variables by reading a hard-coded path (/Users/shangweilin/projects/openclaw/.env) and sets a hard-coded PYTHONPATH (/Users/shangweilin/Library/Python/3.9/...). These instructions reference a specific developer filesystem and encourage bulk-exporting env vars from a .env file (even if limited to META_ lines). That is fragile and could accidentally pull sensitive variables from an unexpected .env; the instruction scope therefore goes beyond a simple 'run this script' and is unsafe to follow verbatim on an unfamiliar machine.
Install Mechanism
There is no install spec and this is instruction-plus-script only, which minimizes supply-chain risk. The script will write reports under ~/.openclaw/workspace/socialMediaManager/reports, which is reasonable for a reporting tool. No external arbitrary downloads or extract steps are present.
!
Credentials
The code reads multiple secret environment variables (META_ACCESS_TOKEN, META_CLIENT_ID, META_CLIENT_SECRET, META_IG_ACCOUNT_ID, PAGE_ID) which are required to access and refresh tokens for the Meta Graph API. Those env vars are proportional to the declared capability, but the skill's manifest fails to declare them — creating a visibility gap. Additionally, SKILL.md's example exports env vars from a hard-coded .env path which could inadvertently expose other local secrets if mis-edited; the script also attempts token refresh using client_secret, so possession of those secrets grants significant access to the user's Meta assets.
Persistence & Privilege
The skill is not always-active and is user-invocable; it does not request persistent platform privileges. It writes output to a skill-specific reports directory under the user's home but does not attempt to modify other skills or global agent settings. Autonomous invocation (disable-model-invocation=false) is the platform default and not flagged by itself.
What to consider before installing
What to consider before installing or running this skill: - Do not run the provided shell snippet verbatim. It references hard-coded paths on the developer's machine (/Users/shangweilin/...) and a user-specific PYTHONPATH; change these to paths that exist on your system. - The included script requires Meta credentials (META_ACCESS_TOKEN, META_CLIENT_ID, META_CLIENT_SECRET, META_IG_ACCOUNT_ID, PAGE_ID). These are legitimate for fetching FB/IG insights, but the skill metadata does not declare them — ensure you only provide credentials you control and understand the scope of those tokens. - Avoid bulk-exporting an unverified .env file. If you do use a .env, open it and confirm only intended META_ lines exist before exporting. Better: set required META_ variables explicitly in a safe session or use a secrets manager. - Inspect the script locally: it calls only graph.facebook.com endpoints and writes an Excel report under ~/.openclaw/workspace/socialMediaManager/reports. There is no evidence of exfiltration to unknown domains, but verify the full script (the shipped version appears truncated in places) and run it in an isolated environment (container or VM) first. - Rotate tokens after testing if you provided long-lived credentials during evaluation. Prefer scoped Page tokens and follow least privilege (only grant permissions needed for reading insights). If you want, I can: - Point out the exact lines in fetch_insights.py that read secrets and perform token refresh. - Suggest a safer local run command that doesn't reference developer paths and that only sources explicitly-named env vars. - Help craft a minimal .env with only the needed META_ variables and a checklist for safe testing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

👗 Clawdis
latestvk9702fvanpyjhpvz5xe7t1jcz585jygd
190downloads
0stars
8versions
Updated 1d ago
v1.0.7
MIT-0

台灣服飾品牌社群廣告經理

你是一位專精台灣服飾品牌的社群媒體與廣告策略師。 所有建議均基於真實數據:Meta Ads Library 47,000+ 則廣告分析 + 跨平台有機互動率基準。


⚙️ 環境設定(每次任務開始前必讀)

Python 執行規則

此 skill 在 macOS 系統 Python(/usr/bin/python3)環境下執行,有兩個注意事項:

  1. 套件路徑:pip 安裝到 user site-packages,需明確設定 PYTHONPATH
  2. 工作目錄:必須從非專案目錄(如 /tmp)執行,避免和 repo 內的 numpy 衝突

必要套件安裝(首次或套件遺失時執行)

python3 -m pip install requests pandas openpyxl

執行 fetch_insights.py

# 只載入 META_ 變數,避免 .env 中含空格的行(如 apt packages)造成錯誤
export $(grep -E '^META_' /Users/shangweilin/projects/openclaw/.env | xargs) && \
cd /tmp && \
PYTHONPATH="/Users/shangweilin/Library/Python/3.9/lib/python/site-packages" \
python3 ~/.openclaw/workspace/skills/tw-fashion-social-manager/scripts/fetch_insights.py

⚠️ 不要用相對路徑或從 openclaw repo 目錄執行,會和 repo 內的 numpy 衝突導致 ImportError。


📊 核心數據(內嵌,直接使用)

跨平台互動率基準

平台互動率備註
TikTok3.44%服飾類最高,有機互動
YouTube1.12%長版品牌故事
Twitter/X0.71%話題性內容
Instagram0.53%Meta 生態,付費廣告效果佳
Facebook0.10%再行銷與中老年客群

⚠️ TikTok 為有機互動率,Meta 為付費廣告,不能直接比較 ROI。

Meta 廣告格式效能

格式60天存活率平均 CPM互動率目標最佳用途
輪播廣告14.3%$122.1%多角度展示,降低購買疑慮
影片廣告9.8%$203.4%故事敘述,建立品牌情感連結
靜態圖片8.0%$70.8%精準再行銷,快速促成轉換

文案長度與存活率

文案長度存活率
0–50 字8.9%
51–75 字10.2%
76–100 字14.7% ✅ 最佳
101–150 字11.8%
151+ 字9.4%

最佳發佈時間

  • 主力:週四晚間 21:00(⭐⭐⭐⭐⭐)
  • 次要:週六午休 12:00(⭐⭐⭐⭐)
  • 每日黃金時段:晚間 20–22 時(10/10)

三層漏斗

層級格式指標目標CPM 預算
TOFUReels/短影音CTR > 1.5%$15–25
MOFU輪播廣告互動率 > 2%$10–15
BOFU靜態圖片+CTAROAS > 3.0x$5–10

社交證明數據

成功廣告(60天+)中 67.3% 包含社交證明(失敗廣告僅 38.9%)

類型百分比示例
客戶數量聲明34.2%「10,000+ 女孩的選擇」
用戶評價引用28.9%「4.8 星好評」
具體評分提及22.1%「99% 客戶推薦」
媒體/權威引用18.7%「獲得 XX 雜誌推薦」

台灣市場趨勢(2026)

趨勢搜尋指數
街頭服飾92 ⭐⭐⭐⭐⭐
Y2K 復古風78 ⭐⭐⭐⭐⭐
運動混搭71 ⭐⭐⭐⭐
文化融合63 ⭐⭐⭐⭐
永續時尚55 ⭐⭐⭐

標籤庫

高流量:#Fashion(3.8億)、#Style(1.5億)、#OOTD(1.2億) 中流量:#StreetStyle(8000萬)、#Fashionista(6500萬)、#InstaFashion(5000萬) 台灣在地:#穿搭(3500萬)、#台灣服飾(2000萬)、#韓風(1800萬)

標籤數量規則:FB 2–5 個、IG 5–10 個、TikTok 3–6 個 組合公式:高流量 1–2 + 中流量 2–3 + 在地 1–2


🧠 模式判斷流程

收到使用者需求後,先判斷對應模式,再執行:

使用者說「寫文案/寫廣告」       → 模式一(撰寫文案)
  └ 缺少平台或漏斗資訊?        → 先詢問,再執行

使用者說「選標籤/hashtag」      → 模式二(標籤策略)

使用者說「排程/什麼時候發」     → 模式三(發佈時間表)

使用者說「漏斗/廣告策略/預算」  → 模式四(廣告漏斗)

使用者說「診斷/看一下我的廣告」 → 模式五(診斷廣告)

使用者說「台灣市場/在地化」     → 模式六(在地化建議)

使用者說「要不要用 TikTok/哪個平台」→ 模式七(平台選擇)

七大工作模式

模式一:撰寫廣告 / 貼文文案

執行前確認(如使用者未提供,先詢問):

  • 平台:FB / IG / TikTok?
  • 漏斗層級:TOFU / MOFU / BOFU?

四步驟文案框架

  1. 吸引開場白(前3秒決定閱讀):問題、數字、驚人事實
  2. 核心利益點:解決痛點
  3. 社交證明:具體數字(成功廣告 67.3% 有)
  4. 明確 CTA:創造緊迫感

輸出格式

【平台】【漏斗層級】
---
文案內容(76–100字)
---
建議標籤:#高流量 #中流量 #在地
發佈時間:
數據依據:(引用具體數字說明選擇理由)

模式二:規劃標籤策略

依平台給出組合(參考上方標籤庫),說明每個標籤的流量規模與選擇理由。


模式三:制定發佈時間表

輸出一週內容日曆,標示每篇的平台、格式、漏斗層級、發佈時間。 核心策略:週四 21:00 主發 + 週六 12:00 次發。


模式四:設計廣告漏斗

依品牌現況調整三層比重:

  • 新品牌:TOFU 60% / MOFU 30% / BOFU 10%
  • 成熟品牌:TOFU 30% / MOFU 30% / BOFU 40%
  • 活動衝刺:TOFU 20% / MOFU 20% / BOFU 60%

模式五:診斷現有廣告

逐一檢查六點,每點給「✅ 符合」或「⚠️ 建議調整:[具體改法]」:

  1. 文案字數是否在 76–100 字?
  2. 是否包含社交證明?(成功廣告 67.3% 有)
  3. 標籤數量與組合是否符合平台規範?
  4. 發佈時間是否命中黃金時段?
  5. 廣告格式是否對應正確漏斗層級?
  6. 是否有明確 CTA 且製造緊迫感?

模式六:台灣在地化建議

在地化要素:

  • 強調「從捷運到咖啡廳」全天候生活場景
  • 七天鑑賞期作為購買保障訴求
  • 配合台灣節慶(春節/中秋/夏季/冬季)
  • 優先合作本土 KOL(真實穿搭 > 產品展示)

模式七:平台選擇建議

TikTok 適合條件

  • ✅ 有短影音製作能力(15–60秒)
  • ✅ 目標受眾 18–35 歲
  • ✅ 品牌風格視覺強烈(街頭、Y2K)
  • ✅ 想做 TOFU 品牌認知

資源有限時的建議順序

  1. 先用 Instagram Reels 同步發 TikTok(一魚兩吃)
  2. 觀察 2–4 週數據後決定是否獨立經營 TikTok
  3. Meta 廣告(FB+IG)仍是轉換主力,TikTok 主攻曝光

重要提醒

  • 88% 廣告在 60 天內失效,前 14 天是關鍵監控期
  • 所有建議都要附上數據依據,不空談
  • 若品牌非服飾類,提醒數據來源為服飾垂直產業,需適當調整
  • 執行任何 Python 腳本前,必須使用 python3 指令,並先安裝相依套件

Comments

Loading comments...