Social Media Analytics
ReviewAudited by ClawScan on May 1, 2026.
Overview
The skill is a coherent read-only social analytics connector, but it requires trusting a Boring MCP URL that acts like a credential and can read connected account metrics.
Before installing, make sure you trust Boring with analytics for the connected social accounts. Treat the MCP connector URL like a password, do not paste it into public places, confirm the access is read-only, and revoke or regenerate the token if you stop using the skill.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone who gets the MCP URL may be able to read analytics and account metadata for connected social accounts.
The skill depends on a bearer-style connector URL that grants access to the user's connected social analytics, even though the artifact says the scope is read-only.
Your MCP Server URL (`https://boring.aiagent-me.com/mcp/t/xxxxx...`) contains an embedded authentication token. Treat it like a password
Keep the MCP URL private, verify the connector permissions are read-only, and revoke or regenerate the token if it is shared or no longer needed.
Your social account analytics and related metadata are processed through Boring's infrastructure and the relevant platform APIs.
The artifact discloses that the MCP connector, token storage, and analytics requests rely on an external hosted service rather than only local processing.
The token is stored server-side in Boring's database (MongoDB on DigitalOcean)... Analytics queries are sent from Boring's server (Google Cloud, us-central1) to the platform's API on your behalf.
Use this only if you trust Boring with the connected accounts' analytics data, and review Boring's privacy/security practices before connecting important business accounts.