The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local bash script (scripts/crawlora.sh) to perform API requests. The script includes defensive measures such as validating the CRAWLORA_API_KEY format, enforcing a strict allowlist of API routes and HTTP methods, and preventing shell globbing or path traversal in the request path.
[EXTERNAL_DOWNLOADS]: Data is retrieved from https://api.crawlora.net/api/v1. This is the official API domain belonging to the skill's author, crawlora-org.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external content, including App Store/Google Play reviews and Google Trends data. While this represents a potential surface for indirect prompt injection, the risk is mitigated by the skill's instructions for thematic sampling and the technical restrictions in the helper script that limit interaction to specific, non-administrative API endpoints.
[CREDENTIALS_UNSAFE]: The skill manages the CRAWLORA_API_KEY environment variable securely. The helper script writes the key to a temporary, restricted-permission curl configuration file (mktemp) and uses a trap to ensure the file is deleted immediately after the request, preventing the secret from appearing in process lists or persisting on disk.

app-market-opportunity-research