Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Keyapi Pinterest Analysis

v1.0.0

Discover and analyze Pinterest users, pins, boards, followers, and following — search users, retrieve profile information, explore pin libraries and board co...

0· 80·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for lycici/keyapi-pinterest-analysis.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Keyapi Pinterest Analysis" (lycici/keyapi-pinterest-analysis) from ClawHub.
Skill page: https://clawhub.ai/lycici/keyapi-pinterest-analysis
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: KEYAPI_TOKEN
Required binaries: node
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install keyapi-pinterest-analysis

ClawHub CLI

Package manager switcher

npx clawhub@latest install keyapi-pinterest-analysis
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description (Pinterest analysis) match the actual requirements and behavior: the skill needs node and a KEYAPI_TOKEN and calls a KeyAPI MCP server. There are no unrelated credentials or binaries requested.
Instruction Scope
SKILL.md instructs running scripts/run.js which lists tools, reads schemas, calls MCP tools, caches responses, and can auto-paginate. This stays within the stated purpose, but the tool persists API responses to a local cache and can save the API token to a .env file (the script will write .env). Also the client supports overriding the MCP endpoint via KEYAPI_SERVER_URL, which could redirect calls to an arbitrary server if misconfigured.
Install Mechanism
No download/install script from arbitrary URLs. It uses npm dependencies (package.json) — specifically @modelcontextprotocol/sdk — which is a normal package registry install. No extract-from-URL or non-standard installers were used.
Credentials
Only KEYAPI_TOKEN is declared as required and that is appropriate for an API-backed integration. The code also reads an optional KEYAPI_SERVER_URL (not listed in required.env) to override the server; this is legitimate but worth noting because it can redirect traffic to another endpoint if set.
Persistence & Privilege
always is false and the skill does not request elevated platform privileges. The script writes a .keyapi-cache directory and may write a .env file containing KEYAPI_TOKEN in the skill directory, persisting credentials and API responses locally. The skill can be invoked autonomously by agents (default), which increases blast radius if a token is present.
Assessment
This skill is coherent with its stated Pinterest-analysis purpose, but review the following before installing: 1) The skill will persist API responses into .keyapi-cache and may save your KEYAPI_TOKEN to a .env file in the skill directory — treat that token like a secret. 2) The code supports overriding the MCP endpoint via KEYAPI_SERVER_URL; ensure this is not set to an untrusted URL. 3) Installing runs npm install which will fetch @modelcontextprotocol/sdk from the npm registry — review that dependency if you need extra assurance. 4) Because the agent can invoke skills autonomously by default, avoid leaving a high-privilege token in environment variables if you do not want automated requests made. If any of these behaviors are unacceptable, do not install or remove the token/override before running.
scripts/run.js:52
Environment variable access combined with network send.
!
scripts/run.js:37
File read combined with network send (possible exfiltration).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📌 Clawdis
Binsnode
EnvKEYAPI_TOKEN
Primary envKEYAPI_TOKEN
latestvk97awy3gp6sbd68dyv806t0rmn843f2a
80downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

keyapi-pinterest-analysis

Discover and analyze Pinterest users, pins, boards, and social graphs — from profile lookup and content inventory to follower and following network traversal.

This skill provides comprehensive Pinterest user intelligence using the KeyAPI MCP service. It enables user search and profile retrieval, pin library exploration, board collection browsing, and follower/following network analysis — all through a unified, cache-first workflow.

Use this skill when you need to:

  • Search for Pinterest users by name or keyword
  • Retrieve a user's profile details, follower count, and bio
  • Browse a user's pin library
  • Explore a user's board collections
  • Traverse a user's follower list with cursor-based pagination
  • Analyze a user's following list with bookmark-based pagination

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Prerequisites

RequirementDetails
KEYAPI_TOKENA valid API token from keyapi.ai. Register at the site to obtain your free token. Set it as an environment variable: export KEYAPI_TOKEN=your_token_here
Node.jsv18 or higher
DependenciesRun npm install in the skill directory to install @modelcontextprotocol/sdk

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

MCP Server Configuration

All tool calls in this skill target the KeyAPI Pinterest MCP server:

Server URL : https://mcp.keyapi.ai/pinterest/mcp
Auth Header: Authorization: Bearer $KEYAPI_TOKEN

Setup (one-time):

# 1. Install dependencies
npm install

# 2. Set your API token (get one free at https://keyapi.ai/)
export KEYAPI_TOKEN=your_token_here

# 3. List all available tools to verify the connection
node scripts/run.js --platform pinterest --list-tools

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Analysis Scenarios

User NeedNode(s)Best For
Search users by name or keywordsearch_usersCreator discovery, influencer prospecting
User profile details and statsget_user_informationProfile audit, follower count, bio
User's pin libraryget_pinsContent inventory, pin theme analysis
User's board collectionsget_boardsBoard taxonomy, niche focus areas
Follower list with paginationget_followers_detailAudience sampling, follower network research
Following list with paginationget_following_detailInterest mapping, network affinity analysis

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Workflow

Step 1 — Identify Analysis Targets and Select Nodes

Clarify the research objective and map it to one or more nodes. Typical entry points:

  • User discovery: Use search_users with a keyword → select a target user.
  • Profile audit: Use get_user_information with username to retrieve profile details and extract the numeric userid.
  • Content inventory: Use get_pins + get_boards with username for a full content snapshot.
  • Social graph analysis: Use get_followers_detail + get_following_detail with userid for network traversal.

Two Parameter Naming Conventions

Pinterest endpoints use different parameter names depending on the endpoint:

ParameterTypeUsed by
usernameString (display name/handle)search_users, get_user_information, get_pins
entryString (username or board path)get_boards
useridNumeric string (e.g., 125186202050495625)get_followers_detail, get_following_detail

Obtain the numeric userid from the get_user_information response before calling get_followers_detail or get_following_detail.

get_boardsentry Parameter

get_boards uses an entry parameter (not username). This accepts a username (e.g., broadstbullycom) or a board URL path. Pass the username to retrieve all boards for that user.

get_followers_detail — Two Pagination Identifiers

get_followers_detail uses two separate identifiers:

  • userid — the numeric user ID of the target user
  • node_id — an internal node identifier used with cursor for multi-page traversal

For the first call, pass only userid. Subsequent pages require both node_id and cursor values from the previous response.

get_following_detailbookmark Pagination

get_following_detail uses bookmark (not cursor) for pagination. Pass the bookmark value from the previous response to fetch the next page. Omit for the first call.

Step 2 — Retrieve API Schema

Before calling any node, inspect its input schema to confirm required parameters and available options:

node scripts/run.js --platform pinterest --schema <tool_name>

# Examples
node scripts/run.js --platform pinterest --schema get_user_information
node scripts/run.js --platform pinterest --schema get_followers_detail

Step 3 — Call APIs and Cache Results Locally

Execute tool calls and persist responses to the local cache to avoid redundant API calls.

Calling a tool:

# Single call with pretty output
node scripts/run.js --platform pinterest --tool <tool_name> \
  --params '<json_args>' --pretty

# Force fresh data, skip cache
node scripts/run.js --platform pinterest --tool <tool_name> \
  --params '<json_args>' --no-cache --pretty

Example — search users:

node scripts/run.js --platform pinterest --tool search_users \
  --params '{"username":"interior design"}' --pretty

Example — get user profile:

node scripts/run.js --platform pinterest --tool get_user_information \
  --params '{"username":"tastemade"}' --pretty

Example — get user pins:

node scripts/run.js --platform pinterest --tool get_pins \
  --params '{"username":"tastemade"}' --pretty

Example — get user boards:

node scripts/run.js --platform pinterest --tool get_boards \
  --params '{"entry":"tastemade"}' --pretty

Example — get followers (first page):

# Pass userid from get_user_information response
node scripts/run.js --platform pinterest --tool get_followers_detail \
  --params '{"userid":"125186202050495625"}' --pretty

Example — get followers (subsequent pages):

# Pass node_id and cursor from previous response
node scripts/run.js --platform pinterest --tool get_followers_detail \
  --params '{"userid":"125186202050495625","node_id":"987654321","cursor":"cursor_from_previous_response"}' --pretty

Example — get following (first page):

node scripts/run.js --platform pinterest --tool get_following_detail \
  --params '{"userid":"125186202050495625"}' --pretty

Example — get following (subsequent pages):

# Pass bookmark from previous response
node scripts/run.js --platform pinterest --tool get_following_detail \
  --params '{"userid":"125186202050495625","bookmark":"bookmark_from_previous_response"}' --pretty

Pagination reference:

EndpointPagination methodFirst callSubsequent pages
get_followers_detailcursor + node_idPass userid onlyPass userid + node_id + cursor from response
get_following_detailbookmarkPass userid onlyPass userid + bookmark from response
search_users, get_user_information, get_pins, get_boardsSingle-call or server-managed

Cache directory structure:

.keyapi-cache/
└── YYYY-MM-DD/
    ├── search_users/
    │   └── {params_hash}.json
    ├── get_user_information/
    │   └── {params_hash}.json
    ├── get_pins/
    │   └── {params_hash}.json
    ├── get_boards/
    │   └── {params_hash}.json
    ├── get_followers_detail/
    │   └── {params_hash}.json
    └── get_following_detail/
        └── {params_hash}.json

Cache-first policy:

Before every API call, check whether a cached result already exists for the given parameters. If a valid cache file exists, load from disk and skip the API call.

Step 4 — Synthesize and Report Findings

After collecting all API responses, produce a structured Pinterest intelligence report:

For user profile analysis:

  1. Profile Overview — Username, display name, numeric user ID, bio, follower count, following count, monthly views.
  2. Content Summary — Pin count, board count, content themes and categories.
  3. Board Taxonomy — Board names, pin counts per board, topic diversity.
  4. Pin Analysis — Pin type distribution (images, videos, articles), top engagement pins, recurring topics.

For social graph analysis:

  1. Follower Profile — Sample follower demographics, active categories, engagement signals.
  2. Following Footprint — Accounts followed, category interests, brand affiliations.
  3. Network Signals — Follower-to-following ratio, audience quality indicators.

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Common Rules

RuleDetail
get_boards uses entryPass the username as the entry parameter (not username). The parameter name differs from other endpoints.
userid resolutionget_followers_detail and get_following_detail require the numeric userid. Obtain it from get_user_information response.
get_followers_detail paginationFirst call: pass userid only. Subsequent calls: pass userid + node_id + cursor from the previous response.
get_following_detail paginationUses bookmark (not cursor) for pagination. Pass bookmark from the previous response.
Success checkcode = 0 → success. Any other value → failure. Always check the response code before processing data.
Retry on 500If code = 500, retry the identical request up to 3 times with a 2–3 second pause between attempts before reporting the error.
Cache firstAlways check the local .keyapi-cache/ directory before issuing a live API call.

author: KeyAPI license: MIT repository: https://github.com/EchoSell/keyapi-skills

Error Handling

CodeMeaningAction
0SuccessContinue workflow normally
400Bad request — invalid or missing parametersCheck entry vs username vs userid usage; verify numeric userid format
401Unauthorized — token missing or expiredConfirm KEYAPI_TOKEN is set correctly; visit keyapi.ai to renew
403Forbidden — plan quota exceeded or feature restrictedReview plan limits at keyapi.ai
404Resource not found — user may not exist or account is privateVerify the username; private accounts may have restricted data
429Rate limit exceededWait 60 seconds, then retry
500Internal server errorRetry up to 3 times with a 2–3 second pause; if it persists, log the full request and response and skip this node
Other non-0Unexpected errorLog the full response body and surface the error message to the user

Comments

Loading comments...