The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a bash helper script (scripts/crawlora.sh) to facilitate network communication with the Crawlora API. The script implements security best practices by using temporary configuration files to prevent API keys from appearing in system process lists and by enforcing a strict allowlist of authorized API routes.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data including product details and user reviews from Costco via the Crawlora API, which could theoretically contain malicious instructions designed to influence the agent.
Ingestion points: Data is retrieved through scripts/crawlora.sh and presented to the agent context.
Boundary markers: The skill does not define specific delimiters for external content within its prompt instructions.
Capability inventory: The skill has the capability to perform network requests using curl via the provided bash script.
Sanitization: The helper script provides strong sanitization by URL-encoding all query parameters and explicitly blocking the @ character to prevent unauthorized local file disclosure through curl.

costco-research