The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bash helper script scripts/crawlora.sh to execute curl commands. The script includes robust security measures to prevent command injection, such as:
Restricting the API key to a specific character set (alphanumeric, dots, underscores, dashes).
Using a temporary configuration file for the API key to prevent it from appearing in the system's process list.
Enforcing a strict whitelist of allowed API routes and rejecting paths with dangerous characters like ?, #, %, or path traversal sequences (..).
Using --data-urlencode to ensure that query parameters are safely handled.
[EXTERNAL_DOWNLOADS]: The skill interacts with the external API api.crawlora.net to fetch sports data. The domain is specific to the skill's vendor (crawlora-org) and its usage is consistent with the stated purpose of analyzing football match statistics. No unverified third-party scripts are downloaded or executed.
[INDIRECT_PROMPT_INJECTION]: The skill processes match data and statistics retrieved from external sources. While this presents a surface for indirect prompt injection, the skill includes explicit instructions for the agent to separate retrieved evidence from interpretation, describe numerical contrasts before explaining them, and state evidence gaps rather than inventing claims. These instructions serve as a safeguard against misleading or malicious content within the sports data.

football-match-performance-analysis