Viralevo
PassAudited by ClawScan on May 10, 2026.
Overview
The skill’s trend-advisor purpose is coherent, but users should notice that it relies on an API key, persistent local feedback data, and referenced helper scripts that were not included in the reviewed artifact.
This does not show artifact-backed malicious behavior. Before installing, review the actual source repository because the provided package only included SKILL.md while documenting many Node/Python scripts. Use a limited Tavily API key, be careful about what performance data you log, and verify any weekly schedule or local database behavior.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may not work as documented, or it may depend on code obtained outside the reviewed artifact set.
SKILL.md references multiple local helper scripts, while the supplied manifest says only SKILL.md was present. That means the executable implementation could not be reviewed in these artifacts.
`node {baseDir}/scripts/onboarding.js`; `node {baseDir}/scripts/collect.js`; `python3 {baseDir}/scripts/report.py`; `python3 {baseDir}/scripts/weekly_review.py`Before installing or running the commands, verify the referenced scripts and dependency files from the source repository and ensure they match the advertised behavior.
The skill can consume the user’s Tavily quota and send search queries to Tavily as part of trend collection.
The skill asks the user to add a Tavily API key to the OpenClaw workspace environment so the trend-collection workflow can use Tavily search.
`echo "TAVILY_API_KEY=tvly-xxxx" >> ~/.openclaw/workspace/.env`
Use a dedicated Tavily key with limited quota if possible, and remove or rotate the key if you stop using the skill.
Your niche, keywords, and performance results may be stored locally and reused to influence future trend reports.
The skill records user-reported post outcomes and uses them to change future recommendations.
`Learns from your results — when you report your post outcomes, those signals feed back into the model`
Avoid logging sensitive business metrics unless you are comfortable storing them in the skill’s local database; review any available database or cleanup controls.
If scheduling is enabled, the skill may keep updating its internal scoring state over time without a fresh prompt each week.
The skill describes recurring autonomous self-adjustment of its scoring weights. This is disclosed and aligned with the stated purpose, but it is persistent behavior users should intentionally enable and monitor.
`Self-corrects weekly — every Monday the system reviews its prediction errors and updates its weights automatically`
Confirm whether any schedule is installed, where the weights are stored, and how to pause, reset, or audit weekly updates.