The Agent Skills Directory

[SAFE]: The skill follows security best practices for credential management. The scripts/crawlora.sh script uses a temporary configuration file with restricted permissions (chmod 600) to pass the CRAWLORA_API_KEY to curl, ensuring the secret does not appear in the process list.\n- [SAFE]: The helper script implements robust input validation, including checks for the API key format and a strict whitelist of allowed API paths (/amazon-jobs/categories, /amazon-jobs/job, /amazon-jobs/search).\n- [SAFE]: The script prevents potential file exfiltration by rejecting the @ character in query parameters, which mitigates risks associated with curl's ability to read local files during request construction.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a surface for indirect prompt injection by fetching job descriptions from Amazon's public careers site via the Crawlora API.\n
Ingestion points: Job data is retrieved from the api.crawlora.net endpoints as documented in reference/endpoints.md.\n
Boundary markers: No explicit markers or warnings are used in the script output to distinguish remote content from trusted instructions.\n
Capability inventory: The skill utilizes curl within scripts/crawlora.sh to perform network operations and depends on the agent to process the resulting JSON.\n
Sanitization: The helper script ensures request integrity by validating the API path and URL-encoding all query parameters.

amazon-jobs-research