The Agent Skills Directory

[SAFE]: The skill follows security best practices. The helper script (scripts/crawlora.sh) ensures that API credentials are never passed as command-line arguments (preventing exposure in process lists) by using a temporary, permission-restricted curl configuration file. It also performs strict regex-based whitelisting of API routes and validates the format of the API key to prevent injection.
[EXTERNAL_DOWNLOADS]: The skill communicates with the vendor's official API (api.crawlora.net) to retrieve data. This is a standard vendor-provided resource necessary for the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: Because this tool fetches public content from X (formerly Twitter), the ingested data is untrusted and could contain adversarial instructions. However, the skill implements strong defensive measures, including strict input sanitization and secure parameter handling, and the risk is inherent to the primary purpose of social media research.

x-research