ClawHub

Short Form Market Research Brain

v1.1.0

Real-time social intelligence across TikTok, YouTube Shorts, and Instagram Reels — powered by the Virlo API

⭐ 0· 117·0 current·0 all-time
by@arod90
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
The skill's name, description, and runtime instructions consistently target Virlo's short-form social analytics API. Requested access (a Virlo API key) is expected for this purpose. Minor metadata inconsistencies exist: the registry metadata lists no required env vars/primary credential whereas SKILL.md declares a required api_key; clawhub.json version (1.0.0) differs from registry version (1.1.0); homepage/source fields in the registry are 'none' while clawhub.json points to dev.virlo.ai. These look like sloppy packaging rather than malicious intent, but they should be confirmed.
✓
Instruction Scope
SKILL.md contains explicit API endpoint usage, headers, polling logic, and credit guidance. Instructions only reference the declared config.api_key and standard API endpoints; there are no steps to read unrelated files, system config, or environment variables beyond the API key, nor do they direct data to unexpected endpoints.
✓
Install Mechanism
No install script or binary downloads are present (instruction-only skill). This minimizes on-disk code execution risks.
ℹ
Credentials
Runtime requires a single Virlo API key (config.api_key), which is proportionate to the described functionality. However, the registry metadata claims 'Required env vars: none' and 'Primary credential: none', which contradicts SKILL.md. Confirm the skill configuration mechanism and where you must supply the API key before use.
✓
Persistence & Privilege
The skill is not marked always:true and does not request any system-level persistence or cross-skill configuration. disable-model-invocation is false (normal) — the skill can be invoked autonomously by the agent, which is expected for skills of this type.
Assessment
This skill appears to be what it says: an agent integration for the Virlo short-form analytics API that needs only your Virlo API key. Before installing: 1) Verify the dev.virlo.ai links and developer identity (clawhub.json lists 'virlo' and dev.virlo.ai) to ensure you're giving credentials to the right service. 2) Expect to supply and store a Virlo API key (virlo_tkn_...), and consider using a key with limited scope or a dedicated account. 3) Review credit costs and set expectations — many operations consume credits; track X-Credits-Remaining and avoid unexpected charges. 4) Note metadata mismatches (registry says no env vars but SKILL.md requires api_key, and version/homepage differ); ask the publisher to reconcile them if that matters for your governance. 5) Because the skill can be invoked autonomously (normal default), only enable it if you're comfortable the agent may call the Virlo API on your behalf. If any of these points are unclear, request the publisher clarify the metadata and provide an authoritative homepage or source repository before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97dstk57ve74p14zjqnxs7tcn83qwjh

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments