自动监控指定关键词的TikTok热门视频评论并定时发送配置的自动回复，支持频率限制和多模板切换。

This skill appears to be a simple TikTok auto-reply tool but has several warning signs: (1) it expects TikTok API credentials but those are stored in a local config.json (plaintext) rather than declared as secure env vars — avoid committing that file and keep credentials out of shared/workspace repos; (2) index.js currently contains placeholder/mock API methods (no real HTTP calls), so the published package may be incomplete or a template — review/replace the API calls before giving it real credentials; (3) documentation/script mismatches (references to watch.js) indicate sloppy maintenance — verify the correct run command (npm run watch or node index.js watch); (4) installing runs npm install which will fetch node-fetch from the public registry — inspect package.json and the installed node_modules before running; (5) automated posting can violate TikTok terms and risk account suspension — test in dryRun mode and use a throwaway/test account first. Recommended next steps: review index.js for any real network endpoints, confirm where/when credentials are used, move secrets to a secure location (env vars or a secrets manager), run in an isolated environment, and verify the upstream repository before trusting it.

Type: OpenClaw Skill Name: tiktok-auto-reply Version: 1.0.0 The skill is a legitimate automation tool template for TikTok auto-replying, containing clear risk warnings regarding account bans and terms of service. The code in index.js is a functional skeleton that manages rate limiting and template selection without any signs of data exfiltration, obfuscation, or malicious execution; all sensitive API credentials are kept in a local config.json file as per standard practices.