Listing Swarm

Submit your AI product to 70+ AI directories. Agent automates form filling, captcha solving (BYOK 2captcha), and email verification (BYOK IMAP). Save 10+ hours of manual submissions. User provides their own API keys - no credentials stored in skill.

Security Scan

The skill's code and instructions match its stated purpose (automating directory submissions using your captcha service and optional IMAP access), but the origin is unclear and there are a few metadata/integration mismatches and sensitive runtime privileges you should review before installing.

Purpose & Capability

Name, description, required binaries (node), env vars (CAPTCHA_API_KEY, CAPTCHA_SERVICE, IMAP_*), and included files (captcha.js, email.js, directories.json) are consistent with the stated purpose of automated form submission, captcha solving, and optional IMAP-based verification. No unrelated credentials or surprising binaries requested.

Instruction Scope

SKILL.md and DOCS describe visiting submit pages, filling forms, sending captcha images to the user-supplied captcha service, and connecting to IMAP to extract verification links — all within expected scope. Two items to note: (1) SKILL.md's embedded metadata sets disable-model-invocation: true while the registry flags show disable-model-invocation: false — this inconsistency should be clarified (it affects whether the agent can run the skill autonomously). (2) The skill automates actions that some directories may forbid (ToS/legal risk), which the docs flag but you should consider.

Install Mechanism

There is no installer; this is instruction-plus-code that runs under node. No downloads from untrusted URLs or archived installs are present. Runtime imports (node-fetch, imap, mailparser) are used, but no install spec means the runtime environment must already provide these modules or the agent platform must supply them.

Credentials

Requested env vars (CAPTCHA_API_KEY, CAPTCHA_SERVICE, IMAP_USER, IMAP_PASSWORD, IMAP_HOST) are necessary for the described functionality. IMAP_PASSWORD grants full mailbox access, so using a dedicated submission-only email and provider app-password is important (the docs recommend this). The number and type of secrets are proportionate, but high-sensitivity (email access) warrants caution and least-privilege handling.

Persistence & Privilege

Skill does not request always:true and tracks submissions locally in submissions.json (expected). Potential risk derives from whether the agent is allowed to invoke the skill autonomously: registry flags vs SKILL.md metadata conflict on disable-model-invocation; if the platform allows autonomous invocation and the environment exposes the secrets to the agent, the skill could perform many network actions without additional prompts. No evidence the skill modifies other skills or system-wide config.

What to consider before installing

What to check before installing: 1) Confirm the skill source/trustworthiness (homepage is missing and owner is an ID only). 2) If you run it, use a dedicated submission email (app-password) and an account specifically for captcha payments; do not reuse your personal or high-value account credentials. 3) Verify the disable-model-invocation setting with the platform (SKILL.md says true but registry shows false) — if the skill can run autonomously, consider restricting invocation or running in a sandbox. 4) Review the code files (captcha.js, email.js) yourself or have someone you trust audit them; they appear readable and do exactly what's described, but unknown origin increases risk. 5) Monitor network activity while first runs (or run in isolated environment), and rotate/revoke keys/passwords after testing if you have concerns. If you want lower risk, run only with captcha key and do manual email verification (omit IMAP credentials).

A Clawdbot skill to list your AI product on 70+ AI directories.

Your agent does the submissions. You bring your captcha API key. Human assists when stuck.

---

🔒 Security Model: BYOK (Bring Your Own Key)

This skill contains ZERO credentials. All API keys and passwords are provided by YOU at runtime via environment variables. Nothing is stored, logged, or transmitted to LinkSwarm.

What	Security
Captcha API	✅ Your key, your account, your billing
Email/IMAP	✅ Your credentials, optional, never stored
Data flow	✅ Your product info → directory forms (that's it)
Source code	✅ Fully readable, no obfuscation

See SECURITY.md for complete security documentation.

---

What It Does

Automates submitting your AI tool to directories like:

• There's An AI For That
• Futurepedia
• OpenTools
• TopAI.tools
• AI Tool Guru
• 65+ more

Setup

1. Get Your Own Captcha Solver API Key (Required)

⚠️ You must get your own API key. The skill does not include one.

1. Go to 2Captcha.com (recommended)
2. Create an account
3. Add funds (~$3 covers 1000 captchas, enough for all 70 directories)
4. Copy your API key from the dashboard

Then add to your environment:

export CAPTCHA_API_KEY="your-own-2captcha-key"
export CAPTCHA_SERVICE="2captcha"

Alternative services (same process):

• Anti-Captcha
• CapSolver

No API key? The agent will flag each captcha for you to solve manually.

2. Email Access for Auto-Verification (Optional)

Most directories send verification emails. Your agent can handle these automatically if you provide IMAP access.

Recommended: Create a dedicated email for submissions:

[e-mail]

For Gmail:

1. Create the email account (or use existing)
2. Enable 2-Factor Auth: Google Account → Security → 2-Step Verification
3. Create App Password: Google Account → Security → App passwords → Generate
4. Copy the 16-character password

Set environment variables:

export IMAP_USER="[e-mail]"
export IMAP_PASSWORD="xxxx xxxx xxxx xxxx"  # app password, not your real password
export IMAP_HOST="imap.gmail.com"

No email access? Agent will flag you: "Check your email for verification link from Futurepedia"

3. Your Product Info

Create a product config the agent can reference:

{
  "name": "Your Product Name",
  "url": "https://yourproduct.ai",
  "tagline": "One line description (60 chars)",
  "description": "Full description for directory listings...",
  "category": "AI Writing Tool",
  "pricing": "Freemium",
  "logo_url": "https://yourproduct.ai/logo.png",
  "screenshot_url": "https://yourproduct.ai/screenshot.png",
  "email": "[e-mail]"
}

Usage

Tell your Clawdbot agent:

"Use the listing-swarm skill to submit my product to AI directories. My product info is in product.json. My 2captcha key is in the environment."

The agent will:

1. Load the directory list
2. Visit each directory's submit page
3. Fill out the form with your product info
4. Solve captchas using your API key
5. Flag you if it gets stuck (needs login, payment, etc.)
6. Track what's submitted

Human-in-the-Loop

When the agent hits something it can't handle:

• "Hey, this directory needs you to create an account first"
• "This one requires payment for listing"
• "Captcha failed 3 times, can you solve this one?"

You solve it, tell the agent to continue.

Directory List

Full list in directories.json. Includes:

• Directory name and URL
• Submit page URL
• Domain rating
• Monthly traffic
• Free vs paid listing
• Notes on submission process

Tracking

Submissions tracked in submissions.json:

{
  "directory": "Futurepedia",
  "status": "submitted",
  "submitted_at": "2026-02-09",
  "listing_url": null,
  "notes": "Pending review"
}

Files

listing-swarm/
├── SKILL.md           # This file
├── directories.json   # 70+ AI directories with submit URLs
├── submissions.json   # Track your submissions
└── captcha.js         # Captcha solver integration

Tips

• Start with free directories - Many accept free submissions
• Have screenshots ready - Most require at least one
• Consistent branding - Use same name/tagline everywhere
• Check emails - Many send verification links

Why This Exists

Getting listed on AI directories is tedious. 70+ sites, each with different forms. Your agent can do the grunt work while you handle the few things that need a human.

Part of LinkSwarm - the AI visibility network.