The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bash helper script (scripts/crawlora.sh) to interface with the API. The script is designed with defensive programming: it implements strict path validation using regular expressions and case statements to ensure only documented eBay routes can be called. It also validates the API key format to prevent shell injection via the environment variable.
[DATA_EXFILTRATION]: The helper script includes a specific check that rejects any query arguments containing the @ character. This is a critical safeguard to prevent curl from interpreting arguments as local file paths (the @file syntax), which could otherwise be used to exfiltrate sensitive local data to the API endpoint.
[CREDENTIALS_SAFE]: The skill correctly manages the CRAWLORA_API_KEY by reading it from the environment. To prevent credential leakage in process lists (e.g., via ps), it writes the key to a temporary, restricted-permission curl configuration file (chmod 600) that is automatically deleted when the script finishes.
[EXTERNAL_DOWNLOADS]: The skill interacts with https://api.crawlora.net/api/v1. This is the official API endpoint for the skill's vendor (Crawlora), and all network traffic is directed to this single, hardcoded base URL.
[DYNAMIC_EXECUTION]: While the script uses dynamic path construction for API calls, it employs anchored extended regular expressions to ensure path parameters are exactly one path segment long, preventing path traversal attacks.

ebay-research