TikTok Shop Automation

提供TikTok Shop店铺商品管理、订单处理、数据分析和营销自动化的全方位电商运营解决方案。

What to check before installing: - Confirm credential handling: the SKILL.md suggests using environment variables, but the code stores credentials and settings under ~/.clawhub/tiktok-shop (config.json and credentials.json). If you install, expect secrets to be written to disk; ensure you are comfortable with that storage location and permissions. - Review destinations you will send data to: enabling Feishu integration or configuring webhooks will transmit orders/customers/reports to those external endpoints. Only configure trusted webhook URLs and Feishu app tokens/table IDs when you understand what data will be sent. - Use Mock mode first: the code defaults to a Mock API for TikTok; test in mock mode until you verify behavior. Switch to real API only after reviewing the code and testing in an isolated environment. - Audit sensitive exports: commands and SKILL.md allow exporting customer lists and reports. If you have PII in your store, confirm export and notification settings before running scheduled automations. - Code quality notes: there are minor mismatches and bugs (for example, some functions shadow/import names which can cause runtime errors). Verify and run tests in a sandboxed VM or container before connecting production accounts. - Verify provenance: registry metadata lists a repository and homepage, but source 'Source' field here is unknown. If you rely on this skill in production, prefer packages from verified authors or review the full source and maintainers. If you want, I can: (1) point out exact lines where credentials are persisted, (2) show where data is sent to Feishu/webhooks, or (3) suggest safe minimal configuration steps to test in mock mode.

Type: OpenClaw Skill Name: tiktok-shop-automation Version: 1.0.0 The TikTok Shop Automation bundle is a legitimate e-commerce management tool providing features for product listing, order processing, and data analysis. It includes integrations with the TikTok Shop API and Feishu (Lark) for notifications. While the tool handles sensitive information such as API secrets and session cookies (found in bin/cli.js and commands/account.js), it follows security best practices by storing credentials in the user's home directory with restricted file permissions (0o600, as seen in src/config.js). The code is well-structured, lacks obfuscation, and contains no evidence of data exfiltration or malicious intent.