The Agent Skills Directory

[SAFE]: No security issues detected in the provided skill files.
[COMMAND_EXECUTION]: The skill utilizes a bash helper script (scripts/crawlora.sh) to interface with the Crawlora API. The script is well-hardened, implementing input validation that restricts API keys to safe character sets and uses a strict allow-list of regex patterns to ensure only authorized API routes can be accessed. It also includes protections against path traversal and URL smuggling.
[DATA_EXFILTRATION]: The skill communicates with api.crawlora.net, which is the official API endpoint for the skill's vendor. API keys are handled via the CRAWLORA_API_KEY environment variable and are passed to curl using a temporary configuration file that is automatically removed on exit, effectively preventing the key from appearing in process listings or logs.
[INDIRECT_PROMPT_INJECTION]: While the skill ingests external data from various datasets, it returns the results as structured JSON for the agent's consumption. It does not use this data to perform sensitive file operations or execute system commands, adhering to best practices for handling untrusted external content.

crawlora-datasets