ThreadClaw FastAPI (Queue + Publish)

• Analyzed: May 11, 2026, 4:46 AM
• Findings: 1
• Version: 1.0.1
• Hash: 7fcd020c4871966857aeacbdf59f36a30d7d47c4e10a270c48902943b6e99b63
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to interact with a user's FastAPI backend via HTTP for managing Threads posts. Crucially, the `SKILL.md` explicitly instructs the AI agent to use an 'HTTP tool' and *not* `exec`, significantly mitigating shell injection risks. It also includes security best practices like validating the base URL, not logging secrets, and not forwarding secrets to shell commands. While any agent skill has a prompt injection surface, the instructions themselves are security-conscious and show no malicious intent or risky capabilities beyond its stated purpose of making HTTP calls.