The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external data from Threads, creating a potential surface for indirect prompt injection.
Ingestion points: Data is fetched from Threads profiles, posts, and search results via the Crawlora API using scripts/crawlora.sh.
Boundary markers: The instructions do not specify explicit delimiters for the external data, relying on the agent's internal processing.
Capability inventory: The skill's capabilities are limited to making authenticated network GET requests to the vendor's API base URL.
Sanitization: The helper script implements strict regex-based path whitelisting and URL-encodes all query parameters, preventing the manipulation of the API request structure.
[COMMAND_EXECUTION]: The skill utilizes a bash script scripts/crawlora.sh to perform network operations via curl.
The script implements several security best practices: it validates the environment-supplied API key for safe characters, uses a hardcoded base URL to prevent redirection, and employs a whitelist of allowed API paths verified via regex.
Sensitive API keys are handled securely by writing them to a temporary configuration file with restricted permissions (chmod 600), which is automatically deleted upon script termination, preventing exposure in process listings.
[EXTERNAL_DOWNLOADS]: The skill fetches data from api.crawlora.net.
This resource is the official API endpoint for the skill's vendor and is used to retrieve the Threads data required for the skill's primary function.

threads-research