The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses curl to interact with api.crawlora.net. This is the core functionality of the skill (Pinterest research) and targets the vendor's own infrastructure (crawlora-org). These network operations are expected and do not involve sensitive data exfiltration.
[COMMAND_EXECUTION]: A helper script scripts/crawlora.sh is provided to wrap curl commands. The script uses standard shell practices (set -euo pipefail) and includes safety measures like --data-urlencode to prevent command injection through query parameters. Usage is limited to intended API interactions.
[CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage their API keys using environment variables (CRAWLORA_API_KEY) rather than hardcoding them. It includes specific warnings against committing or hardcoding keys.
[DATA_EXFILTRATION]: No evidence of unauthorized data exfiltration was found. The skill only accesses public Pinterest data (profiles, pins, boards) through the authenticated Crawlora API.

pinterest-research