The Agent Skills Directory

[SAFE]: The skill implements security best practices for handling API credentials by advising the use of environment variables and using temporary curl configuration files to prevent the API key from appearing in process lists.
[SAFE]: The provided helper script scripts/crawlora.sh includes robust input validation, including regex-based path whitelisting and restrictions to only allow GET requests, which effectively prevents common command and path injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from Amazon listings and reviews via the Crawlora API. While this creates a potential surface for indirect prompt injection, the risk is classified as safe due to the skill's read-only nature, URL-encoded inputs, and path-restricted network requests. Evidence: Data enters via scripts/crawlora.sh from the API; no boundary markers are specified in the prompt; capabilities are limited to network GET requests; sanitization is performed via URL encoding in the bash script.

amazon-research