social-media-research
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages credentials using the
CRAWLORA_API_KEYenvironment variable, which is a recommended secure practice for AI skills. Network requests are directed exclusively to the author's official API domain (api.crawlora.net). - [COMMAND_EXECUTION]: The provided helper script
scripts/crawlora.shusescurlto interact with the API. It correctly uses shell arrays and URL encoding to handle user-provided arguments, preventing common shell injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external, untrusted sources (social media platforms).
- Ingestion points: Data retrieved from Instagram, TikTok, Reddit, and other platforms via the Crawlora API (referenced in
reference/endpoints.md). - Boundary markers: Absent; the skill does not explicitly instruct the agent to ignore instructions embedded in the social media data.
- Capability inventory: Subprocess execution via
scripts/crawlora.shusingcurl. - Sanitization: Absent; data is returned as raw JSON. While inherent to research tools, the use of structured JSON output naturally mitigates risks compared to raw text processing.
Audit Metadata