The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were detected. The skill's instructions and supporting scripts follow security best practices for handling external data and user credentials.
[COMMAND_EXECUTION]: The bundled helper script (scripts/crawlora.sh) implements robust input validation. It enforces an allowlist of permitted API routes and rejects paths containing special characters or traversal sequences (e.g., .., //, %). All query parameters are safely URL-encoded using curl's built-in flags to prevent shell injection.
[DATA_EXFILTRATION]: Secret management for the CRAWLORA_API_KEY is handled securely. The script avoids exposing the key in command-line arguments by using a temporary curl configuration file. This file is created with restricted user-only permissions (umask 077 and chmod 600) and is automatically deleted upon execution via a bash trap. Additionally, the script prevents potential local file exfiltration by explicitly blocking the @ character in arguments, which disables curl's ability to read data from local files.
[REMOTE_CODE_EXECUTION]: The skill does not perform any remote code execution or dynamic script installation. Network operations are strictly limited to the hardcoded vendor domain api.crawlora.net over HTTPS.

collectibles-market-research