Tiktok Trend Slayer
v1.1.4“TikTok Shop Full-stack analytics and operations toolkit for cross-border sellers. From data fetching to daily operations — seven workflows covering the enti...
⭐ 2· 200·0 current·0 all-time
by@skovely
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description, the bundled shell script, and SKILL.md all describe fetching influencer data from EchoTik and optional product data from TikTok Shop. The required credentials (ECHOTIK_AUTH_HEADER, optional TIKTOK_SHOP_API_KEY) and dependencies (curl, jq) are appropriate and expected for this functionality. Note: the registry summary at the top of the package listing claimed "Required env vars: none" which contradicts the SKILL.md and script that do require ECHOTIK_AUTH_HEADER (and optionally TIKTOK_SHOP_API_KEY). This appears to be a packaging/metadata inconsistency, not an indication of unrelated privileges.
Instruction Scope
Runtime instructions tell the agent to set auth env vars, run the included script, and read/write report files in the skill output directory. The script only performs HTTP GETs to two expected APIs, validates JSON, and writes reports. It does not attempt to read unrelated system files or other credentials. Workflows reference generating PDF/Excel using standard libraries—these are recommendations rather than automatic remote steps.
Install Mechanism
No install spec; the skill is instruction-only with a bundled shell script. No remote downloads or archive extraction are performed by the skill itself. Risk is limited to executing the included shell script locally (standard low-risk distribution model for CLI tools).
Credentials
The script requires a single service credential (ECHOTIK_AUTH_HEADER) and optionally TIKTOK_SHOP_API_KEY for product data — both are justified by the described API calls. The only proportionality issue is the metadata mismatch: registry-level fields claim no required env vars while SKILL.md declares required envs. Also note the script expects a Basic auth header containing base64(user:pass) — treat this as sensitive and provide least-privilege credentials or short-lived tokens.
Persistence & Privilege
Flags: always=false, user-invocable=true, disable-model-invocation=false (default). The skill does not request permanent platform-wide presence or modify other skills/configs. Autonomous invocation is enabled by default (normal), so consider this if you allow the agent to run skills without prompts, but it is not itself a discrepancy.
Assessment
This skill appears to do what it says: it calls EchoTik and (optionally) TikTok Shop APIs and writes reports to a local output directory. Before installing or running it:
- Verify the publisher/source: check the referenced GitHub repo (SKILL.md lists a repo URL) and inspect the files there to confirm authenticity. The package's top-level registry metadata omitted required env vars — confirm the repo and packager.
- Treat credentials as sensitive: only provide ECHOTIK_AUTH_HEADER and TikTok tokens that are least-privileged or short-lived. Do not paste long-lived master secrets into an environment used for other things.
- Review network endpoints: the script calls https://open.echotik.live and https://api.tiktokshop.com. If you do not trust those endpoints or the third-party EchoTik service, do not provide credentials.
- Run in a sandbox/isolated environment first: execute the script with dummy or read-only credentials and inspect created output files before granting real credentials.
- Inspect outputs: reports include raw API JSON responses; they may contain PII or business-sensitive data. Do not publish outputs without review.
- If you are concerned about automatic runs, restrict agent autonomy (prevent background/autonomous invocation) or set up monitoring and rotate tokens after use.
If you want, I can: (1) fetch and summarize the GitHub repo contents, (2) point out exact lines where credentials are used, or (3) suggest a minimal test command that uses no real credentials so you can validate behavior safely.Like a lobster shell, security has layers — review code before you run it.
DaRenvk975peh4zvxwedzbyvyryygagh83s6cqEcommerce_Agentvk975peh4zvxwedzbyvyryygagh83s6cqTikTokvk975peh4zvxwedzbyvyryygagh83s6cqTikTokShopvk975peh4zvxwedzbyvyryygagh83s6cqXuanPinvk975peh4zvxwedzbyvyryygagh83s6cqlatestvk975peh4zvxwedzbyvyryygagh83s6cq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.