threads-net-api
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill facilitates network communication with
api.scavio.dev(the vendor's official domain) to retrieve public social media data. It uses an API key (SCAVIO_API_KEY) for authentication, which is handled via environment variables or headers, following security best practices. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Threads (posts, replies, and profile descriptions).
- Ingestion points: Data enters the agent's context through several endpoints such as
/threads/profile,/threads/user/posts, and/threads/post/comments(SKILL.md). - Boundary markers: No specific boundary markers or instructions to ignore embedded commands are present in the documentation.
- Capability inventory: The skill primarily performs read operations and does not possess capabilities like arbitrary command execution, file system writes, or secondary network exfiltration that could be triggered by malicious content in a post.
- Sanitization: The instructions do not specify content sanitization, but they do provide guardrails against data fabrication and attribution loss.
Audit Metadata