Back to skill
Skillv1.0.1
ClawScan security
Virlo Short-Form Video Training Data · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 17, 2026, 6:47 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only wrapper for the Virlo API that requests a single API key and uses curl to call virlo.ai endpoints — its requirements and instructions are consistent with the stated purpose.
- Guidance
- This skill is coherent: it simply describes how to call the Virlo API using curl and a single API key. Before installing, confirm you trust the Virlo service and the api.virlo.ai domain, and only provide an API key you intend to use for this integration. Prefer creating a scoped/revocable key from the Virlo dashboard, avoid sending sensitive PII in queries you submit to the service (Orbit searches post keywords to the API), and monitor/revoke the key if you see unexpected usage. If you need stronger assurance, verify the GitHub source and the Virlo service terms/privacy policy referenced in the SKILL.md.
Review Dimensions
- Purpose & Capability
- okName/description (viral video analytics, hashtags, trends) align with the declared requirement of a Virlo API key and curl usage; nothing requested (no extra services or credentials) appears unrelated to social-media analytics.
- Instruction Scope
- okSKILL.md contains curl examples that call https://api.virlo.ai and instruct the agent to use the VIRLO_API_KEY environment variable. It does not instruct reading local files, other env vars, or sending data to unexpected endpoints. Note: docs and playground URLs reference dev.virlo.ai, which is for documentation only; runtime endpoints are api.virlo.ai.
- Install Mechanism
- okNo install spec or code files — instruction-only. The only required binary is curl, which is reasonable for the provided cURL examples and low risk because nothing will be written to disk by the skill itself.
- Credentials
- okOnly a single credential (VIRLO_API_KEY) is required and is declared as the primary credential. The SKILL.md uses this variable consistently. There are no unrelated secrets or multiple unrelated env vars requested.
- Persistence & Privilege
- okalways is false and the skill is user-invocable; it does not request persistent system changes or broader agent configuration. Autonomous invocation is allowed by default but not combined with other concerning privileges.