The Agent Skills Directory

[SAFE]: The skill employs a well-designed helper script (scripts/crawlora.sh) for API interactions that implements multiple security layers:
Credential Security: The CRAWLORA_API_KEY is validated against a strict character set and passed to curl via a temporary configuration file, preventing the key from being exposed in process listings or command history.
Route Enforcement: The script hardcodes the vendor's API base URL (https://api.crawlora.net/api/v1) and validates all requested paths against an explicit allow-list of approved endpoints.
Input Validation: All query parameters are URL-encoded using curl -G --data-urlencode, and the script explicitly rejects characters (like @) that could be used to manipulate file reading behavior.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external complaint narratives from the BBB, which is a potential surface for indirect prompt injection. However, the risk is mitigated by the following factors:
Ingestion points: External data enters the context through JSON payloads returned by scripts/crawlora.sh.
Boundary markers: The instructions explicitly direct the agent to categorize and attribute narratives as "distinct attributed evidence," separating them from the agent's own reasoning.
Capability inventory: The skill lacks any dangerous capabilities such as file system writes (outside of temporary config), arbitrary code execution (eval/exec), or shell command injection.
Sanitization: The helper script ensures that all outgoing request data is properly encoded.

business-complaint-pattern-analysis