The Agent Skills Directory

[COMMAND_EXECUTION]: The helper script scripts/crawlora.sh implements robust security controls. It includes a character whitelist for the API key to prevent configuration injection and uses a temporary config file to pass secrets to curl, ensuring they do not appear in process listings. Additionally, it blocks the use of the @ character in arguments to prevent unauthorized file reads via curl's file-upload feature.
[DATA_EXFILTRATION]: The skill performs network operations targeting api.crawlora.net. This is the legitimate endpoint for the vendor's service and is necessary for the skill's operation.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from the Crawlora API, which serves as a potential surface for indirect instructions.
Ingestion points: Data enters via API responses in scripts/crawlora.sh.
Boundary markers: None explicitly defined in instructions; results are processed as JSON.
Capability inventory: Includes shell command execution and network access (GET requests).
Sanitization: Request parameters are URL-encoded, and the script enforces a strict whitelist of allowed API routes.

gaming-research