Influencer Report

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears purpose-aligned for influencer vetting, but users should know it requires Memories.ai API keys and sends creator/video URLs to Memories.ai services.

Before installing, confirm you are comfortable providing Memories.ai API keys and sending creator profile/video URLs to Memories.ai services. The visible behavior is consistent with influencer report generation, but the registry metadata under-declares the required credentials and one result-polling endpoint is not documented in the main endpoint list.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If installed and used, the skill can use the user's Memories.ai credentials to submit scraping, search, transcript, and metadata requests, potentially consuming account quota and accessing that provider-side library.

Why it was flagged

The skill requires provider API keys even though the registry metadata lists no primary credential or required environment variables. The keys are clearly disclosed in the skill instructions and are aligned with the Memories.ai integration.

Skill content

Required environment variables:
- `MEMORIES_V1_API_KEY` — Memories.ai V1 API key (scraper, library, search)
- `MEMORIES_API_KEY` — Memories.ai V2 API key (MAI transcript, metadata)

Recommendation

Use appropriately scoped Memories.ai keys if available, monitor provider usage, and do not provide credentials unless you are comfortable with the skill using them for the documented Memories.ai operations.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Creator profile URLs and video URLs are sent to Memories.ai, and profile scraping may ingest recent videos into the user's Memories.ai library.

Why it was flagged

The script sends profile/video data to Memories.ai API endpoints to scrape and analyze influencer content. This is expected for the stated reporting purpose, but users should notice that it performs external API actions.

Skill content

resp = requests.post(url, headers=headers, json=payload, timeout=30)

Recommendation

Run the skill only for creator profiles or video URLs you intend to analyze, and choose scrape counts that match your reporting needs.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Task IDs and analysis results may pass through or be retrieved from a separate Memories-related demo endpoint, which users may not expect from the documented endpoint list.

Why it was flagged

The code polls a separate demo.memories-ai.org webhook-style endpoint for task results. This endpoint is not listed in the SKILL.md API endpoint table, so the result-retrieval data boundary is less clearly disclosed.

Skill content

webhook_url = f"https://demo.memories-ai.org/webhooks/memories/result/{task_id}"

Recommendation

Verify with the provider that this result endpoint is intended for production use, and avoid using private or sensitive videos unless the data handling is acceptable.