The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a bash helper script (scripts/crawlora.sh) to execute curl commands. The script is highly defensive and incorporates several security best practices:
Credential Management: It validates the CRAWLORA_API_KEY format and passes it to curl using a temporary configuration file with restricted permissions (chmod 600), ensuring the secret does not appear in process monitoring tools.
Path Whitelisting: API endpoints are restricted to a specific allowed list. Paths with parameters are validated using anchored extended regular expressions to prevent path traversal or unauthorized API access.
Input Sanitization: The script uses curl --data-urlencode for all query parameters and explicitly rejects the @ character to prevent local file inclusion vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process external data from the Crawlora API, which creates a potential surface for indirect prompt injection.
Ingestion points: Data is retrieved from api.crawlora.net as JSON via the scripts/crawlora.sh helper.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to isolate the API data from its system prompt.
Capability inventory: The skill is limited to data retrieval and does not have the capability to write files or modify the system environment based on API responses.
Sanitization: While the script validates input parameters sent to the API, the content of the API response itself is processed directly by the agent without further sanitization.

auction-research