Youtube Reporter by CreatorDB

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a coherent CreatorDB API reference for looking up YouTube creator data, with only purpose-aligned notes about using curl, an API key, and an external service.

This looks safe to use for CreatorDB YouTube lookups if you expect it to call CreatorDB’s API. Before installing, be aware that it needs curl and a CREATORDB_API_KEY even though the registry requirements say none, and that API requests may reveal your lookup queries to CreatorDB and consume quota.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill can send creator search terms or channel identifiers to CreatorDB and may consume API quota.

Why it was flagged

The skill documents user-directed curl calls to CreatorDB. This is expected for an API lookup skill, but users should know that searches and channel IDs are sent to an external service.

Skill content
curl --request POST \
  --url https://apiv3.creatordb.app/youtube/search
Recommendation

Use it when you are comfortable sending the requested YouTube lookup data to CreatorDB, and monitor API usage if quota or billing matters.

What this means

Anyone using the skill needs a CreatorDB API key, and requests made with it may access the associated account’s quota or permissions.

Why it was flagged

The API examples authenticate with a CreatorDB API key. This is purpose-aligned for the CreatorDB service and there is no artifact evidence of logging, hardcoding, or unrelated credential use.

Skill content
--header "api-key: $CREATORDB_API_KEY"
Recommendation

Use a dedicated CreatorDB key if possible, keep it out of shared prompts or logs, and rotate it if exposed.

What this means

The registry may not warn users up front that they need curl and a CreatorDB API key.

Why it was flagged

SKILL.md declares a curl and API-key requirement, while the registry fields list no required binaries or environment variables. This appears to be an under-declaration rather than hidden behavior because the commands plainly show curl and the API key.

Skill content
metadata: {"moltbot":{"emoji":"🐽","requires":{"bins":["curl"],"env":["CREATORDB_API_KEY"]},"primaryEnv":"CREATORDB_API_KEY","install":[]}}
Recommendation

Confirm the environment has curl available and configure CREATORDB_API_KEY intentionally before invoking the skill.