The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a helper script scripts/crawlora.sh to perform API requests via curl. The script is securely implemented, using set -euo pipefail for robust error handling and --data-urlencode for all query parameters, which prevents command injection from potentially malicious search queries or handles.- [EXTERNAL_DOWNLOADS]: The skill connects to api.crawlora.net to fetch Bluesky data. This network activity is restricted to the vendor's own infrastructure and is necessary for the skill's primary function of providing external research capabilities.- [CREDENTIALS_UNSAFE]: Authentication is handled correctly by requiring the CRAWLORA_API_KEY to be set as an environment variable. The skill provides clear instructions on this secure practice and avoids hardcoding secrets or exposing them in command-line arguments.- [PROMPT_INJECTION]: The skill retrieves untrusted content from external Bluesky profiles and posts (indirect prompt injection surface). However, it serves as a data aggregator that returns clean JSON to the agent and does not possess high-privilege capabilities (like arbitrary code execution or file system modification) that could be exploited by malicious data embedded in those posts.

bluesky-research