The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a helper script scripts/crawlora.sh to make API calls via curl. The script implements robust security controls: it enforces strict allow-lists for API routes, validates that the CRAWLORA_API_KEY contains only safe characters, and rejects potentially dangerous shell characters in path and query arguments.
[CREDENTIALS_UNSAFE]: The skill requires an API key provided via the CRAWLORA_API_KEY environment variable. The helper script handles this securely by writing the key to a temporary file with restricted permissions (chmod 600) and using curl --config to avoid exposing the secret in the process list. It also provides a link to the vendor's site for users to obtain their own key, rather than providing one.
[EXTERNAL_DOWNLOADS]: The skill interacts with api.crawlora.net, which is the official API endpoint for the vendor 'crawlora-org'. This is consistent with the skill's stated purpose and author.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (creator tier descriptions and benefit copy). While this is an ingestion surface, the skill is limited to comparison and analysis. It explicitly instructs the agent not to perform high-risk actions based on this data, such as subscribing, paying, or messaging creators, which effectively mitigates the impact of potential indirect injections.

creator-membership-comparison