Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly a public Threads research helper, but its bundled API script is broader than that purpose and can send arbitrary requests with the user's Crawlora API key.
Review this before installing if you only want a tightly scoped Threads skill. Use it only with non-sensitive Threads handles, post IDs, and search terms, keep CRAWLORA_API_KEY in secure environment storage, and avoid setting CRAWLORA_API_BASE unless you intentionally trust that endpoint. A safer version would restrict the helper to the documented read-only /threads endpoints.
Endpoints this skill uses, grouped by platform. Call them via `scripts/crawlora.sh` (see SKILL.md).
All paths are relative to the API base `https://api.crawlora.net/api/v1` and require the header `x-api-key: $CRAWLORA_API_KEY`. Path params like `{id}` are substituted into the URL; `GET` params go in the query string; `POST` params go in a JSON body.
**5 endpoints across 1 platform group(s).**curl -fsS -G "${auth[@]}" "${qs[@]}" "${base}${path}"
else
[ -n "$body" ] || body="${rest[0]:-{}}"
curl -fsS -X "$method" "${auth[@]}" \
-H "Content-Type: application/json" -d "$body" "${base}${path}"
fiset -euo pipefail
: "${CRAWLORA_API_KEY:?Set CRAWLORA_API_KEY first — get a free key at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills}"
base="${CRAWLORA_API_BASE:-https://api.crawlora.net/api/v1}"
method="GET"
body=""VirusTotal findings are pending for this skill version.
Detected: suspicious.exposed_secret_literal