TopYappers - Creators & Viral Content Skills
v1.0.0TopYappers — social media intelligence for AI agents. Discover viral TikTok content, search 30M+ creators across TikTok/Instagram/YouTube, and track trending...
⭐ 0· 76·0 current·0 all-time
byTadas Gedgaudas@tadasgedgaudas
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's name/description match what the SKILL.md files instruct (search creators, viral content, trending songs). The only mismatch: registry metadata lists no required credential, but the runtime instructions assume an API key (Bearer token) configured in MCP/.mcp.json. This is plausible (MCP-managed keys) but the metadata omission should be noted.
Instruction Scope
All runtime instructions are limited to calling the TopYappers MCP endpoint (https://mcp.topyappers.com) and describing request/response fields. The SKILL.md files do not instruct reading unrelated local files, environment variables, or contacting unexpected endpoints.
Install Mechanism
There is no install spec and no code files — this is instruction-only, so nothing is written to disk by an installer. Lowest-risk install surface.
Credentials
The SKILL.md instructs adding a Bearer API key to the MCP config, but the registry metadata does not declare any required env var or primary credential. Also, some API calls (get_creator_profiles) return contact emails and other PII — ensure you intend to provide and allow use of an API key that permits access to such data and that this aligns with your privacy policy.
Persistence & Privilege
always is false and disable-model-invocation is false (normal). The skill does not request persistent system-level privileges or modifications to other skills. Autonomous invocation is allowed by default but not combined with other red flags here.
Assessment
This is an instruction-only connector that calls an external TopYappers API — the behavior described matches the skill name. Before installing: 1) Confirm you trust the provider (topyappers.com / the GitHub repo) since the skill will send requests to an external service. 2) Be aware the SKILL.md expects you to supply an API key in MCP/.mcp.json (the registry metadata didn’t explicitly declare this) — do not reuse sensitive platform-wide credentials; use a dedicated TopYappers API key. 3) Some endpoints return PII (emails) and follower/contact data — ensure you’re allowed to fetch and store that data and consider least-privilege API keys. 4) Check billing/credit costs and rate limits before heavy use. If you want higher assurance, ask the publisher for a homepage, clear owner contact, or a signed package manifest that explicitly lists the credential requirement and data handling policy.Like a lobster shell, security has layers — review code before you run it.
latestvk9720w4qytaff460mjnw29th1n83hzcr
License
MIT-0
Free to use, modify, and redistribute. No attribution required.