ClawHub

Boring Social Analytics

v1.0.1

Track social media performance and analytics across platforms using Boring. Use when the user says 'show my analytics', 'check social media performance', 'ho...

⭐ 0· 68·0 current·0 all-time
by@snoopyrain
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (social analytics aggregator) match the declared requirement: an MCP connector URL that contains an embedded auth token used to query social platforms. No unrelated credentials, binaries, or install steps are requested.
✓
Instruction Scope
SKILL.md only instructs the agent to use Boring-provided calls (boring_get_performance, boring_get_video_analytics, etc.) and to add the MCP Server URL as a Connector. It does not instruct the agent to read arbitrary local files, other environment variables, or to exfiltrate data to unexpected endpoints. The instructions explicitly note the MCP link is a credential and that queries go through Boring's servers.
✓
Install Mechanism
No install spec and no code files — instruction-only skill. This minimizes on-disk risk; nothing is downloaded or executed locally by the skill itself.
ℹ
Credentials
The only credential required is the MCP Connector link (embedded token) which is appropriate for a connector-based analytics integration. Note: the token is embedded in a URL rather than an env var; users should understand that pasting that link into the agent grants Boring access to the connected social accounts' analytics.
✓
Persistence & Privilege
always is false and there are no requests to modify other skills or system-wide settings. The skill relies on a connector token and behaves as a typical, non-persistent integration.
Assessment
This skill is coherent for its stated purpose, but before installing: (1) treat the MCP Server URL like a password — only paste it into agents or connectors you trust; (2) verify the domain (boring-doc.aiagent-me.com / boring.aiagent-me.com) and the service's privacy/permissions to ensure you are comfortable with Boring querying your social accounts; (3) use least-privilege or regenerate the MCP token if it is ever exposed; (4) remember the skill sends analytics to Boring's servers — do not use it with accounts or data you cannot share with an external service. If you want stronger control, ask whether Boring supports narrower-scoped tokens or per-platform API keys instead of a single embedded-token connector.

Like a lobster shell, security has layers — review code before you run it.

latestvk974y04kb87fbxddwp5rp604en83qr2x

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

📊 Clawdis
ConfigMCP Connector link from boring.aiagent-me.com (contains embedded auth token)

Comments