The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crawlora.net, which is the official API domain for the vendor crawlora-org. These requests are necessary for the skill's primary function of retrieving Threads data and do not represent a security risk.
[COMMAND_EXECUTION]: The scripts/crawlora.sh helper script uses curl to interact with the Crawlora API. It employs safe shell practices (set -euo pipefail) and utilizes curl's --data-urlencode flag to safely handle query parameters, preventing common command injection vulnerabilities.
[CREDENTIALS_UNSAFE]: The skill correctly instructs users to manage their API keys via the CRAWLORA_API_KEY environment variable. There are no hardcoded secrets or sensitive credentials present in the codebase.
[DATA_EXFILTRATION]: No evidence of data exfiltration was found. The skill only transmits user-provided search queries or profile identifiers to the vendor's API and does not access sensitive local files or environment configuration beyond the required API key.

threads-research