The Agent Skills Directory

[SAFE]: The skill is a legitimate utility for comparing flight data and does not exhibit any malicious patterns, obfuscation, or unauthorized access attempts.
[COMMAND_EXECUTION]: The skill utilizes a local bash script (scripts/crawlora.sh) to wrap API calls. This script follows security best practices to prevent exploitation:
Input Validation: It enforces an allowlist of specific API paths and HTTP methods, preventing the agent from accessing unintended endpoints.
Credential Security: The API key is passed to curl via a temporary configuration file with restricted permissions (600), ensuring it does not appear in process lists or logs.
File Disclosure Protection: It explicitly blocks the @ character in query parameters and uses stdin for POST bodies to prevent curl from reading local files through its file-referencing syntax.
[EXTERNAL_DOWNLOADS]: The skill communicates with api.crawlora.net. As this domain belongs to the skill's author (crawlora-org), this is classified as standard vendor-owned infrastructure communication.
[INDIRECT_PROMPT_INJECTION]: The skill processes itinerary data from external providers.
Ingestion points: Flight search results and amenity details are fetched from Agoda and Expedia via the Crawlora API.
Boundary markers: No specific boundary markers are defined for the ingested data.
Capability inventory: The skill is limited to making network requests to the author's API base URL.
Sanitization: The helper script properly encodes query parameters and handles POST data safely to prevent command or parameter injection.

flight-itinerary-comparison