The Agent Skills Directory

[SAFE]: The skill is well-structured and follows security best practices for AI agent extensions. No malicious patterns or obfuscation were detected across the analyzed files.\n- [COMMAND_EXECUTION]: The shell script scripts/crawlora.sh is hardened against injection attacks. It implements strict path allow-listing for API routes and uses curl with --data-urlencode to ensure that query parameters are safely handled.\n- [DATA_EXFILTRATION]: Network operations are restricted to the vendor's official API domain (api.crawlora.net). The skill manages sensitive credentials securely by requiring the CRAWLORA_API_KEY to be provided via the environment and passing it to curl using a temporary, restricted-permission configuration file, which prevents the key from appearing in process listings.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from TikTok but includes clear instructions for the agent to distinguish between retrieved data and its own analysis. It explicitly warns the agent not to claim it has viewed media unless the environment supports it, reducing the risk of hallucinations or obedience to instructions embedded in TikTok content.

tiktok-trend-research