The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/crawlora.sh manages all API interactions using curl. It includes robust input validation, such as ensuring the CRAWLORA_API_KEY follows an alphanumeric format and restricting HTTP methods to GET only.
[CREDENTIALS_UNSAFE]: Secrets are managed securely by reading from the CRAWLORA_API_KEY environment variable. The skill uses a temporary curl configuration file with restricted permissions (chmod 600) to pass the header, ensuring the API key does not appear in process monitoring tools like ps.
[DATA_EXFILTRATION]: The script includes protection against curl-specific injection attacks by explicitly rejecting the @ character in query arguments, which prevents the utility from reading and uploading local files. It also enforces a strict whitelist of allowed API routes via regex checks.
[SAFE]: All network operations are directed to the vendor's official and hardcoded API endpoint at https://api.crawlora.net/api/v1, minimizing the risk of data being sent to unauthorized third-party domains.

fiverr-research