The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a helper script scripts/crawlora.sh to facilitate API requests. It uses standard curl commands and follows best practices for input handling, such as using --data-urlencode to prevent command injection via parameters.
[DATA_EXPOSURE]: The skill requires an API key but correctly instructs the user to provide it via an environment variable (CRAWLORA_API_KEY) rather than hardcoding it in the skill or scripts. It includes a specific warning against committing the key to version control.
[EXTERNAL_DOWNLOADS]: The skill communicates with api.crawlora.net and provides documentation links to crawlora.net. These are identified as the official resources for the skill's vendor ('crawlora-org') and do not represent a security risk.
[REMOTE_CODE_EXECUTION]: No patterns of downloading and executing remote scripts (e.g., pipe to bash) or dynamic code evaluation were detected. All network operations are scoped to fetching JSON data from the vendor's API.

gaming-research