The Agent Skills Directory

[SAFE]: The skill communicates with the Crawlora API at https://api.crawlora.net/api/v1. This is the official API for the skill vendor (crawlora-org), and all external communication is scoped to this domain.
[SAFE]: The helper script scripts/crawlora.sh employs industry-standard security practices for handling the CRAWLORA_API_KEY. It uses a temporary curl configuration file created with mktemp and restricted permissions (chmod 600) to pass the API key to the HTTP client. This ensures the sensitive credential is never exposed in process lists, shell history, or command-line arguments.
[SAFE]: The helper script implements a robust whitelist for API routes using case patterns and rejects any paths containing suspicious characters (.., //, ?, #, %). This prevents path traversal and unauthorized access to non-job-related API endpoints.
[SAFE]: Input security is maintained by using curl --data-urlencode for all query parameters, and the script explicitly forbids the @ character in arguments to prevent curl from inadvertently reading local files.

ats-job-boards-research