The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/crawlora.sh uses curl to interact with the Crawlora API. It properly handles arguments and uses --data-urlencode for GET parameters to prevent command injection or malformed URL issues.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crawlora.net, which is the official API domain for the vendor crawlora-org. These requests are necessary for the skill's primary purpose of fetching structured web data.
[CREDENTIALS_UNSAFE]: The skill demonstrates safe credential management by instructing users to export their API key to the CRAWLORA_API_KEY environment variable rather than hardcoding it in scripts or prompts. It explicitly warns against hardcoding keys or committing them to version control.
[DATA_EXFILTRATION]: While the skill performs network operations, it only sends user-defined search queries and parameters to the vendor's API. There is no evidence of accessing sensitive local files or exfiltrating user environment data.
[PROMPT_INJECTION]: The instructions in SKILL.md are descriptive and functional, focusing on how to use the tool. There are no patterns suggesting attempts to override agent safety filters or bypass instructions.

crawlora