The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a helper script (scripts/crawlora.sh) to perform network requests via curl. The script implements several defensive measures to ensure security:
It validates the CRAWLORA_API_KEY format to prevent shell injection or configuration file manipulation.
It uses a temporary curl configuration file (with restricted permissions) to pass the API key, preventing it from appearing in the process tree.
It implements a strict allow-list for API routes using both static case matching and anchored regular expressions to prevent directory traversal or access to unintended API surfaces.
It restricts query parameters to exclude the @ character, mitigating certain curl file-upload vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill communicates exclusively with the vendor's official API domain (api.crawlora.net). These communications are part of the intended functionality and follow the vendor's standard protocol.
[CREDENTIALS_UNSAFE]: The skill correctly instructs the user to manage their API key via an environment variable (CRAWLORA_API_KEY) and does not contain any hardcoded secrets or sensitive credentials.

film-box-office-comparison