The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local helper script scripts/crawlora.sh to perform network requests via curl. The script implements several security hardening measures, including:
Strict whitelisting of allowed API paths and HTTP methods.
Regex validation for parameterized routes.
Rejection of the @ character in query parameters to prevent curl-based local file disclosure attacks.
Use of --data-urlencode for GET parameters and piped input for POST bodies to prevent shell or argument injection.
[CREDENTIALS_UNSAFE]: The skill follows secure practices for credential management. The CRAWLORA_API_KEY is retrieved from environment variables and passed to curl using a temporary configuration file (--config), ensuring the secret does not leak into system process lists.
[INDIRECT_PROMPT_INJECTION]: The skill processes structured data (JSON) retrieved from the Crawlora API. Although ingesting external data provides a theoretical surface for indirect prompt injection, the risk is minimal because the instructions focus on data reconciliation, deduplication, and matrix reporting, rather than executing instructions found within the data.
[DATA_EXFILTRATION]: Network communication is restricted to the vendor's official API domain (api.crawlora.net). There are no patterns indicating the unauthorized transmission of sensitive local files or environment configuration.

chain-store-footprint-analysis