← 返回 Skills 市场

Influencer Report

Name: Influencer Report
Author: shawnshenopeninterx

作者 shawnshenopeninterx · GitHub ↗ · v2.0.0

cross-platform ⚠ suspicious

436

总下载

当前安装

版本数

在 OpenClaw 中安装

/install influencer-report

功能描述

Generate a comprehensive influencer vetting report. Use when someone asks to vet, analyze, or review an influencer/creator. Takes a creator profile URL or vi...

使用说明 (SKILL.md)

Influencer Report Skill

Vet influencers by analyzing their recent videos with Memories.ai V1 + V2 APIs.

Setup

Required environment variables:

MEMORIES_V1_API_KEY — Memories.ai V1 API key (scraper, library, search)
MEMORIES_API_KEY — Memories.ai V2 API key (MAI transcript, metadata)

Quick Start

From a profile URL (auto-scrapes recent videos):

python3 scripts/influencer_report.py --handle charlidamelio \
  --profile-url "https://www.tiktok.com/@charlidamelio" --scrape-count 5

From direct video URLs:

python3 scripts/influencer_report.py --handle creator_name --platform tiktok \
  --videos https://tiktok.com/@user/video/1 https://tiktok.com/@user/video/2

Workflow

Scrape — V1 /scraper ingests creator's recent videos from their profile URL
List & Search — V1 /list_videos and /search retrieve the ingested content
Analyze — V2 MAI Transcript API provides visual + audio analysis per video
Metadata — V2 Metadata API pulls engagement stats (views, likes, comments)
Score & Report — Content quality scoring + formatted markdown report

API Endpoints Used

Step	API	Endpoint
Scrape profile	V1	`POST /serve/api/v1/scraper`
List library	V1	`POST /serve/api/v1/list_videos`
Search library	V1	`POST /serve/api/v1/search`
MAI transcript	V2	`POST /serve/api/v2/{platform}/video/mai/transcript`
Video metadata	V2	`POST /serve/api/v2/{platform}/video/metadata`

Report Format

See references/report-format.md for the full template and scoring guide.

安全使用建议

This skill appears to implement influencer vetting via Memories.ai, but there are inconsistencies and a potentially risky webhook domain. Before installing: (1) confirm the registry metadata is updated to declare the two required MEMORIES_* API keys; (2) review and verify the webhook URL (demo.memories-ai.org) — ask the publisher whether this is an official Memories.ai endpoint or just a demo; (3) search the code for any places where a callback_url could be set to an arbitrary endpoint and avoid passing sensitive API keys or production data to unknown callbacks; (4) run the scripts in an isolated/test environment and with limited/test API keys first; (5) request publisher identity/homepage or source provenance — if they can’t justify the demo webhook or fix the metadata mismatch, treat the package cautiously and avoid providing production API keys.

功能分析

Type: OpenClaw Skill Name: influencer-report Version: 2.0.0 The skill is classified as suspicious due to a potential markdown injection vulnerability in the generated report. The `scripts/generate_report.py` script constructs markdown output using strings derived from API responses (e.g., video titles, transcripts, notes) and direct user input (e.g., `--handle`). If these strings contain malicious markdown or HTML, a vulnerable markdown renderer (such as the one used by the OpenClaw agent or a web interface displaying the report) could be exploited for content injection or cross-site scripting (XSS). While there is no evidence of intentional malicious behavior, this lack of output sanitization constitutes a vulnerability.

能力评估

⚠ Purpose & Capability

The skill's stated purpose (influencer vetting using Memories.ai) matches the code and SKILL.md: it scrapes profiles and calls Memories.ai V1/V2 endpoints. However the registry metadata lists no required environment variables or credentials while both SKILL.md and the scripts require two Memories.ai API keys — an incoherence that should be resolved. Also the code uses a webhook/polling URL on demo.memories-ai.org (different from api.memories.ai / mavi-backend.memories.ai), which is unexpected and requires justification.

⚠ Instruction Scope

Instructions tell the agent to scrape profile URLs, submit videos to Memories.ai, poll a webhook for results, and produce reports — all consistent with the declared function. But the poll_result implementation contacts a hard-coded demo.memories-ai.org webhook endpoint (not clearly documented in SKILL.md). The code also supports supplying a callback_url for the scraper, which could be used to send scraped data to arbitrary endpoints. These behaviors expand the data flow beyond just calling Memories.ai APIs and could result in data leaving the environment.

ℹ Install Mechanism

There is no install spec (instruction-only install) and no packaged dependency list. The scripts use Python and the requests library; nothing is downloaded or executed on install. Lack of a declared dependency list means you must ensure the runtime environment has Python and required packages (requests). This is not inherently malicious but is an operational omission.

⚠ Credentials

The code requires two Memories.ai keys (MEMORIES_V1_API_KEY and MEMORIES_API_KEY), which are proportional to the described functionality. However the registry incorrectly lists no required env vars — a metadata mismatch. No other credentials are requested, but the presence of a callback_url parameter and the hard-coded demo webhook endpoint means data could be pushed/polled to a third party, so keys and data could be exposed if endpoints are not legitimate.

✓ Persistence & Privilege

The skill does not request persistent or elevated privileges (always:false, user-invocable). It doesn't modify other skills or system settings. Autonomous invocation remains allowed (platform default) but is not by itself a red flag here.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install influencer-report
安装完成后，直接呼叫该 Skill 的名称或使用 /influencer-report 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v2.0.0

V1+V2 workflow: scrape profiles via V1, analyze with V2 MAI transcript + metadata. No Apify dependency.

v1.1.0

Remove Apify/Exa deps, use Memories.ai API only

v1.0.1

Remove Apify/Exa deps, use Memories.ai API only

v1.0.0

- Initial release of the Influencer Report Skill. - Generates comprehensive influencer vetting reports using AI analysis of recent videos. - Supports influencer vetting, analysis, and brand safety review based on handle/name and platform. - Scrapes profiles, analyzes recent videos, scores content quality, and produces structured reports. - Requires Memories.ai and Apify API keys for operation; Exa AI key is optional.

元数据

Slug influencer-report

版本 2.0.0

许可证 —

累计安装 1

当前安装数 1

历史版本数 4

常见问题