The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a bash script (scripts/crawlora.sh) to execute curl commands for API interaction. The script incorporates several security best practices: it validates the format of the API key, uses a private temporary configuration file to prevent credentials from appearing in the process list, and restricts execution to a whitelist of approved API paths.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data including restaurant menus and diner reviews, which are surfaces for potential indirect prompt injection.
Ingestion points: Restaurant profiles, menus, and reviews are retrieved from Resy and OpenTable via the Crawlora API.
Boundary markers: The skill instructions do not explicitly define markers to delimit external content.
Capability inventory: The skill is restricted to read-only research (GET requests) and lacks capabilities for file modification, arbitrary command execution, or sensitive data access.
Sanitization: The helper script uses URL encoding for parameters and strictly validates API paths against a predefined whitelist.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to api.crawlora.net to retrieve restaurant data. This operation is necessary for the skill's primary function and targets the infrastructure provided by the skill's author.

dining-demand-research