The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/crawlora.sh implements defensive programming practices including strict route allowlisting via regex and case statements, path validation to prevent traversal or smuggling, and parameter encoding via curl --data-urlencode.
[CREDENTIALS_SAFE]: The skill manages the CRAWLORA_API_KEY by reading it from the environment and passing it to curl through a temporary configuration file with 600 permissions. This prevents the sensitive key from appearing in the system's process list and ensures it is removed immediately after use via a shell trap.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user input through search queries in various endpoints. While this represents a theoretical surface for indirect injection if an attacker-controlled movie title contains instructions, the skill's capabilities are limited to GET requests to a hardcoded API, and the script properly sanitizes path parameters and query arguments.

entertainment-discovery-research