lowkey viral

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a coherent instruction-only wrapper for a video-generation API, but users should notice that it uses a paid API key and can consume credits when requests are made.

Before installing, make sure you are comfortable giving the agent access to a lowkey viral API key and allowing it to send your prompts or creative briefs to the lowkey viral API. Treat generation requests as paid actions because they can consume credits.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If used, the agent can make authenticated requests to the user's lowkey viral account and may consume plan credits.

Why it was flagged

The skill uses a paid-service API key as a Bearer token, which is expected for this integration but gives the agent access to act against the user's lowkey viral account.

Skill content

Requires a lowkey viral API key (PRO or ULTIMATE plan) ... Authorization: Bearer $LOWKEY_VIRAL_API_KEY

Recommendation

Use a dedicated lowkey viral API key if possible, monitor credit usage, and revoke or rotate the key if it is no longer needed.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Running the documented requests can spend paid API credits to generate briefs, images, and renders.

Why it was flagged

The documented workflow uses curl POST requests that create resources and consume credits. This is purpose-aligned for generating videos, but it is still an account-impacting operation.

Skill content

curl -s -X POST https://lowkeyviral.com/api/v1/briefs ... Step 1 — Generate AI Briefs (2 credits)

Recommendation

Confirm the requested video or slideshow parameters before allowing generation, especially when using higher-cost image models or repeated attempts.