The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/crawlora.sh executes the curl command to interact with the Crawlora API. The script includes significant security hardening: it validates the API key format to prevent shell injection, uses a strict allow-list for API routes, and employs --data-urlencode to ensure user-supplied parameters are safely handled as data rather than command arguments. It also explicitly blocks curl's file-access syntax (@).
[CREDENTIALS_SAFE]: The skill follows secure practices for handling API keys. It expects the CRAWLORA_API_KEY to be provided via an environment variable and uses a temporary file with restricted permissions (600) to pass the header to curl. This prevents the key from appearing in process lists or shell history. The temporary file is automatically cleaned up on exit.
[EXTERNAL_DOWNLOADS]: The skill communicates with api.crawlora.net to retrieve job posting data. This domain belongs to the skill's vendor and is used for its primary documented purpose.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from job postings.
Ingestion points: Data is retrieved from the /apple-jobs/search and /apple-jobs/job endpoints.
Boundary markers: The script returns raw JSON data; instructions do not provide explicit boundary markers for the agent.
Capability inventory: The skill is limited to performing GET requests to specific job-related API endpoints and does not have write access or general shell execution capabilities.
Sanitization: Query parameters are URL-encoded by the helper script.

apple-jobs-research