The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a bundled bash script (scripts/crawlora.sh) to perform API requests. The script is professionally secured, featuring: 1. Strict route whitelisting using case patterns and anchored regular expressions to prevent path traversal or route smuggling. 2. Prevention of credential leakage by using a temporary curl configuration file with restricted permissions (umask 077 and chmod 600) and ensuring the file is removed on exit. 3. Input validation that restricts the API key to a specific character set and URL-encodes all query parameters.
[DATA_EXFILTRATION]: The skill makes network requests to api.crawlora.net. This is the official API of the skill's author, crawlora-org, and is used solely to retrieve the app metadata and privacy labels required for the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from App Store and Google Play descriptions. 1. Ingestion points: App metadata retrieved via scripts/crawlora.sh. 2. Boundary markers: The instructions explicitly direct the agent to separate original store fields from its own interpretation and evidence-based matrix. 3. Capability inventory: The skill is restricted to read-only network operations and data analysis; it lacks capabilities for file-system modification or credential harvesting. 4. Sanitization: All parameters passed to the store APIs are strictly validated and encoded by the helper script.

app-privacy-disclosure-comparison