Virlo Short-Form Video Training Data

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a purpose-aligned Virlo API reference, but it uses your Virlo API key to make authenticated requests and may create searches or monitoring jobs.

This appears safe to install if you intend to let your agent query Virlo. Before use, make sure you are comfortable providing a Virlo API key, and require confirmation before creating searches, async jobs, or scheduled monitoring.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone using the skill should understand that requests are made with their Virlo account credentials.

Why it was flagged

The skill requires a Virlo API key and uses it for authenticated API calls. This is expected for the integration, but it gives the agent access under the user's Virlo account.

Skill content
Set `VIRLO_API_KEY` environment variable... Authorization: Bearer ${VIRLO_API_KEY}
Recommendation

Use a dedicated or limited-scope Virlo key if available, keep it out of shared logs or files, and revoke it from the Virlo dashboard if compromised.

What this means

The agent could make Virlo API calls on the user's behalf, including creating searches or jobs if the user asks for those workflows.

Why it was flagged

The skill exposes raw authenticated API calls through curl, including POST operations. This is central to the API-reference purpose, but write operations should be intentional.

Skill content
Use `curl` directly with the `VIRLO_API_KEY` environment variable... # POST request with JSON body
Recommendation

Confirm any POST or resource-creating request before running it, especially if it may consume credits, change account state, or start monitoring.

What this means

Monitoring or scraping jobs could continue in the Virlo service after the immediate request is complete.

Why it was flagged

The documented service can create asynchronous or scheduled monitoring activity. The behavior is disclosed and purpose-aligned, but it may persist outside a single chat turn.

Skill content
**Orbit** — Keyword-based social listening with async analysis jobs; **Comet** — Automated niche monitoring with scheduled scraping
Recommendation

Ask the agent to clearly identify when it is creating, listing, or deleting persistent Virlo jobs, and periodically review active jobs in the Virlo dashboard.