Security audit

Short Form Market Research Brain

Security checks for vulnerabilities and agentic risk

Overview

ClawScan returns a benign verdict with medium confidence: the skill appears aligned with its stated content research purpose, though it uses Virlo’s external API and the scan was partial.

Before installing, decide whether you are comfortable using Virlo and sending it research intent, keywords, or other request details. Keep confidential information out of those requests, and protect the API key in your OpenClaw configuration. The verdict is benign, but the scan is incomplete: Skillspector reports 10 of 11 components scanned, with partial inspection and unresolved references, so it cannot provide full assurance.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (65)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.
md
lse&include_inactive=true`: List agents. - `GET /v1/agents/:id`: Config + autopilot state (`autopilot`, `pinned_keywords`) + latest run + merged latest analysis + `finalized` / `pending_jobs` + in-flight run progress (`progress_pct` / `stage` / `eta_seconds`). - `PUT /v1/agents/:id`: Update mutable config (not collection scope). `{"active": false}` pauses a recurring agent and `{"active": true}` resumes it. `{"autopilot": false}` turns autopilot off and `true` turns it back on. Changing `keywords` or `intent` clears `intent_keywords` until the next run. Sending `keywords` or `exclude_keywords` replaces the list, and on an API-created agent that list becomes the pinned set autopilot always keeps (the user's edits win). - `DELETE /v1/agents/:id`: Delete for good (204). No more runs or charges, and the agent drops off every list; it cannot be turned back on, but `GET /v1/agents/:id` and its data reads keep working, so save the id. To stop for a while, pause instead. **Read (all Free):**

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.
md
ing: true` replaces `/v1/comet`). Existing `orbit_id`/`comet_id` values remain valid agent ids, and every read sub-path below also works verbatim under `/v1/agents/:id/…`. Do not build new integrations on these. - `POST /v1/orbit`: $0.50. → `POST /v1/agents` with `is_recurring: false`. Reads (all Free): `GET /v1/orbit/:orbit_id` (poll), `/videos`, `/slideshows`, `/ads`, `/creators/outliers`, `/sounds`, `/analysis/latest`, `/analysis/history`, `/trends/latest`, `/trends/history`; list `GET /v1/orbit`. - `POST /v1/comet`: $0.50 per run. → `POST /v1/agents` with `is_recurring: true` + `cadence`. Manage: `GET /v1/comet`, `GET/PUT/DELETE /v1/comet/:id`. Reads (all Free): same sub-paths as `/v1/orbit` plus `/hashtags`, `/benchmarks`, `/affinity`, `/creators/:creator_id/similar` (all accept the same filters as their `/v1/agents/:id/…` equivalents). **Satellite (Creator Lookup)**: Deep-dive into any creator's profile and performance, with optional AI trend detection over their body of work.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.
md
- `GET /v1/tracking/creators/:id/posts/collect/:collection_id`: Free. Poll collection job status. - `GET /v1/tracking/creators/:id/posting-cadence`: Free. Get posting frequency analytics (avg gap, posts per week/month, day-of-week stats). - `PATCH /v1/tracking/creators/:id`: Free. Update status ("active" or "paused") or scrape_cadence. Resuming with `{"status": "active"}` alone runs the next paid check right away (within ~5 minutes); changing the cadence restarts the clock from now. - `DELETE /v1/tracking/creators/:id`: Free. Stop tracking (204, soft delete, data retained). - `POST /v1/tracking/videos`: $0.25 to start (covers the first check; the first report lands in under a minute; refunded automatically if the video can't be read), then $0.25 per successful check. A URL you already track returns 400 (not charged). Body: `{ "url": "video_url", "platform": "tiktok" }`. Optional: `scrape_cadence`, `tracking_account_id` (link to a tracked creator). - `GET /v1/tracking/videos`: Free. Lis

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 381)May include surrounding context.
md
- `GET /v1/tracking/videos/:id/report`: Free. Get latest AI analysis report (auto-generated each cycle). - `GET /v1/tracking/videos/:id/snapshots`: Free. Historical metric snapshots: the most recent `limit` in the date range, listed oldest first. Includes `delta_*` fields. - `PATCH /v1/tracking/videos/:id`: Free. Update status or scrape_cadence. - `DELETE /v1/tracking/videos/:id`: Free. Stop tracking (204). The same URL can never be tracked again afterwards (400); the only way back is `PATCH` on the old id. Pause instead if you may want it back. **Audience Demographics & Geography**: Engaged-audience profile (age, gender, country, city, language) for any tracked creator, read it as "who's showing up in the replies," derived from analyzing the creator's commenters rather than the raw follower base. (TikTok has a follower-list fallback when comments are sparse; see the `data_source` taxonomy below.) Snapshots are cached for 30 days; fresh collections are AI-driven and charged on dispatc

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
Your Virlo API key is provided through the VIRLO_API_KEY environment variable (declared in this skill's metadata; OpenClaw injects it from the user's config). All requests require it as a Bearer token:

bash
curl -H "Authorization: Bearer $VIRLO_API_KEY" https://api.virlo.ai/v1/account/balance

If VIRLO_API_KEY is not set, do not guess or ask for the key inline in chat history-sensitive contexts: tell the user to (1) create a key at https://dev.virlo.ai/dashboard and (2) add it to ~/.openclaw/openclaw.json:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
}

text
Base URL: `https://api.virlo.ai/v1` All parameter names and response fields use snake_case. All responses are wrapped in `{ "data": { ... } }`: **except the webhook-management endpoints** (`/v1/webhooks…`), which return a bare array/object with no `data` envelope.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/full-niche-analysis.md (reported line 36)May include surrounding context.

Poll every 30-60 seconds until finalized: true. Half of runs finish collecting in under ~8 minutes and 9 in 10 within ~20, with the AI report a few minutes later; a broad run with ads can take up to 45 min. Don't loop tightly, never hard-timeout, and treat partial_failure as a usable terminal state:

bash
curl https://api.virlo.ai/v1/agents/{id} \ -H "Authorization: Bearer $VIRLO_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/full-niche-analysis.md (reported line 42)May include surrounding context.

Get the AI intelligence report:

bash
curl "https://api.virlo.ai/v1/agents/{id}/analysis/latest" \ -H "Authorization: Bearer $VIRLO_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/full-niche-analysis.md (reported line 48)May include surrounding context.

Get top videos. Apply any view/date filters here at read time (free), since collection is system-managed and broad:

bash
curl "https://api.virlo.ai/v1/agents/{id}/videos?limit=20&order_by=views&sort=desc&min_views=100000&start_date=2026-01-01T00%3A00%3A00Z" \ -H "Authorization: Bearer $VIRLO_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/full-niche-analysis.md (reported line 54)May include surrounding context.

Find rising creators (rank by weighted_score, not raw outlier_ratio, which is the default sort):

bash
curl "https://api.virlo.ai/v1/agents/{id}/creators/outliers?limit=10&order_by=weighted_score&sort=desc" \ -H "Authorization: Bearer $VIRLO_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/monitor-creator-performance.md (reported line 32)May include surrounding context.

After a few cycles, review growth snapshots. You get the most recent limit snapshots (default 30) in the date range, listed oldest first:

bash
curl "https://api.virlo.ai/v1/tracking/creators/{id}/snapshots?start_date=%7Btoday_minus_30%7D&limit=365" \ -H "Authorization: Bearer $VIRLO_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/monitor-creator-performance.md (reported line 38)May include surrounding context.

Read the latest AI report (generated automatically on every cycle):

bash
curl https://api.virlo.ai/v1/tracking/creators/{id}/report \ -H "Authorization: Bearer $VIRLO_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/monitor-creator-performance.md (reported line 44)May include surrounding context.

Enumerate the creator's collected posts with per-post metrics, outlier flags, and the per-post sound object. sound.external_id is the platform-native sound id (TikTok music/clip id, Instagram audio id; null for YouTube) a music catalog matches against: filter or group posts by it to see which tracks a creator uses:

bash
curl "https://api.virlo.ai/v1/tracking/creators/{id}/posts?sort=views_desc&limit=50" \ -H "Authorization: Bearer $VIRLO_API_KEY"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
curl -H "Authorization: Bearer $VIRLO_API_KEY" https://api.virlo.ai/v1/account/balance

text
If `VIRLO_API_KEY` is not set, do **not** guess or ask for the key inline in chat history-sensitive contexts: tell the user to (1) create a key at https://dev.virlo.ai/dashboard and (2) add it to `~/.openclaw/openclaw.json`: ```json5 {

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
### Pricing Per Endpoint | Cost | Endpoints | | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
, billed even when the page is empty; errors (400, 404, 5xx) are not billed | | $0.05 | Hashtag endpoints (list, performance, platform-specific), Sound detail, Sound usage history, **One Content Trend (`GET /v1/content-trends/:id`)**, **Search (`POST /v1/search/videos`, `POST /v1/search/creators`) per library page of 25 that holds results; an empty page and searches of your own research (`my_research`, `agent`) are free**, **Places (`GET /v1/places`, `GET /v1/places/:id/videos`) per call**

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
| | +$0.10 | `sound_artist_resolution`: surcharge on `GET /v1/sounds/:sound_id?resolve=true` when the sound isn't already resolved (Spotify track match → ISRC + canonical artist). Cached resolutions are free. | | $0.10 | Sound search, **Hook template library (`/v1/hooks/library`)**

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
ions are free. | | $0.10 | Sound search, **Hook template library (`/v1/hooks/library`)**

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
gin-only or non-existent creator is refused with `400` `creator_login_required` / `creator_not_found` and no charge; a first check that still fails is refunded), then $0.25 per successful check, Trending sounds, **Breakout sounds (`/v1/sounds/breakout`)**, Sound videos, Creator sounds, **Trending hooks (`/v1/hooks/trending`), Hook search (`/v1/hooks/search`), Agent hooks (`GET /v1/agents/:id/hooks`, free when the agent has `data_intelligence_enabled` or while `coverage.videos_with_hooks` is 0)** | | $0.50 | **Agent one-shot creation (`POST /v1/agents` with `is_recurring: false`, charged at creation)**, **each r

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
| | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
, billed even when the page is empty; errors (400, 404, 5xx) are not billed | | $0.05 | Hashtag endpoints (list, performance, platform-specific), Sound detail, Sound usage history, **One Content Trend (`GET /v1/content-trends/:id`)**, **Search (`POST /v1/search/videos`, `POST /v1/search/creators`) per library page of 25 that holds results; an empty page and searches of your own research (`my_research`, `agent`) are free**, **Places (`GET /v1/places`, `GET /v1/places/:id/videos`) per call**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
| | +$0.10 | `sound_artist_resolution`: surcharge on `GET /v1/sounds/:sound_id?resolve=true` when the sound isn't already resolved (Spotify track match → ISRC + canonical artist). Cached resolutions are free. | | $0.10 | Sound search, **Hook template library (`/v1/hooks/library`)**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
gin-only or non-existent creator is refused with `400` `creator_login_required` / `creator_not_found` and no charge; a first check that still fails is refunded), then $0.25 per successful check, Trending sounds, **Breakout sounds (`/v1/sounds/breakout`)**, Sound videos, Creator sounds, **Trending hooks (`/v1/hooks/trending`), Hook search (`/v1/hooks/search`), Agent hooks (`GET /v1/agents/:id/hooks`, free when the agent has `data_intelligence_enabled` or while `coverage.videos_with_hooks` is 0)** | | $0.50 | **Agent one-shot creation (`POST /v1/agents` with `is_recurring: false`, charged at creation)**, **each r

The research workflow sends user-derived research intent and keywords to Virlo without a privacy warning.

Medium

Category: Output Handling
Confidence: 90% confidence
Finding: These workflow steps instruct the agent to submit the user's research objective and niche keywords to a third-party service. Although the skill identifies Virlo as its API provider, it does not warn that these submissions may disclose confidential business plans, client details, or other sensitive information contained in the research request.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/analyze-creator.md (reported line 13)May include surrounding context.

Start creator lookup:

bash
curl "https://api.virlo.ai/v1/satellite/creator/tiktok/hatimsshorts?include=videos%2Coutliers&max_videos=20" \ -H "Authorization: Bearer $VIRLO_API_KEY"