ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

OnlyFans API Access

v1.0.0

Query OnlyFans data and analytics via the OnlyFansAPI.com platform. Get revenue summaries across all models, identify top-performing models, analyze Free Trial and Tracking Link conversion rates, compare link earnings, and much more! Use when users ask about anything related to OnlyFans.

⭐ 2· 1.7k·0 current·0 all-time
by@martingalovic
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
ℹ
Purpose & Capability
The SKILL.md purpose (query OnlyFansAPI.com for agency analytics) matches the curl/jq workflows in the instructions. However the registry metadata does not declare the single required environment variable (ONLYFANSAPI_API_KEY) or a primary credential, which is inconsistent with the documented runtime needs.
✓
Instruction Scope
Runtime instructions are narrowly scoped to calling https://app.onlyfansapi.com endpoints, paginating, and aggregating responses; they do not instruct reading arbitrary user files or sending data to other endpoints. They do require network access and use of curl/jq. The header 'allowed-tools: Read' is present but the instructions do not enumerate any file reads beyond reading the ONE env var.
✓
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk or downloaded during install — lowest install risk.
!
Credentials
The SKILL.md requires ONLYFANSAPI_API_KEY (Authorization: Bearer $ONLYFANSAPI_API_KEY) which is exactly the kind of secret expected for this integration. However the registry metadata incorrectly lists no required env vars and no primary credential — an incoherence that could be accidental but also hides the credential requirement from automated reviewers. No other unrelated credentials are requested.
✓
Persistence & Privilege
Skill does not request always:true, does not modify other skills or system settings, and runs only when invoked — no elevated persistence or privilege is requested.
What to consider before installing
This skill appears to do what it says (call OnlyFansAPI.com), but exercise caution before installing: the SKILL.md requires ONLYFANSAPI_API_KEY but the registry metadata omits that — verify with the publisher. Because the skill will use your API key and network access to app.onlyfansapi.com, only provide a key if you trust OnlyFansAPI.com (and prefer a scoped or read-only key for testing). Check that the agent is restricted to the expected domain, confirm the skill's publisher/source (there is no homepage), and ask the author to correct the registry to declare ONLYFANSAPI_API_KEY as the primary credential so automated checks and permissions are accurate.

Like a lobster shell, security has layers — review code before you run it.

latestvk97aqern6g6pbr951f7zk4nkzd80axwe

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments