The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a bash script (scripts/crawlora.sh) to interface with the Crawlora API. This script implements defensive programming by using set -euo pipefail, restricting allowed methods to GET, and validating path structures to prevent directory traversal or URI smuggling.
[CREDENTIALS_UNSAFE]: The skill requires an API key provided via the CRAWLORA_API_KEY environment variable. The helper script handles this securely by writing the key to a temporary file with restricted permissions (chmod 600) and using curl --config, which prevents the secret from being exposed in system process logs.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crawlora.net. As this is the official domain for the skill author's service, these requests are considered legitimate and expected for the skill's stated purpose of analyzing app feedback.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of app reviews from third-party app stores.
Ingestion points: App reviews are fetched from Apple App Store and Google Play Store endpoints.
Boundary markers: The instructions advise the agent to cite excerpts and maintain separate buckets for different data types, reducing the risk of data confusion.
Capability inventory: The skill's primary capability is performing GET requests to a scoped API via scripts/crawlora.sh.
Sanitization: The helper script enforces strict URL encoding on all query parameters using curl --data-urlencode, mitigating injection risks into the HTTP request.

app-release-feedback-analysis