PopUp Referrals
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a read-only PopUp referral dashboard that needs your PopUp API key to show referral and earnings details, with no hidden code or mutation behavior evident.
This skill looks coherent and limited to viewing PopUp referral information. Before installing, confirm you are comfortable giving it a PopUp API key that can read referral earnings, account balance, and referred vendor status.
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may be able to view your PopUp referral link, earnings, account balance, and referred vendor names/status using your API key.
The skill uses an account API key to retrieve referral, earnings, balance, and referred-vendor information. This is expected for the stated purpose and documented as read-only, but it is still account-level access that users should understand before enabling.
The token is the `POPUP_API_KEY` environment variable. ... `GET /referrals` ... Shows earnings stats ... Lists referred vendors and their current status
Use only the intended PopUp API key, prefer the narrowest available scope, avoid sharing outputs publicly, and revoke or rotate the key if you stop using the skill.