The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bash helper script (scripts/crawlora.sh) to interface with the Crawlora API. This script includes several defensive programming practices:
Input Validation: It validates the CRAWLORA_API_KEY format using a strict character set ([A-Za-z0-9._-]) before use.
Path and Method Allow-listing: It restricts HTTP methods to GET and only permits specific API routes (/google-jobs/job and /google-jobs/search).
Injection Prevention: It rejects paths containing special characters (?#%..//) and uses curl --data-urlencode to safely process query parameters, preventing command injection.
[CREDENTIALS_UNSAFE]: The skill follows secure credential management practices. It instructs users to set the CRAWLORA_API_KEY in the environment rather than hardcoding it. The helper script uses a temporary curl configuration file with restricted permissions (chmod 600) to pass the API key, ensuring it does not appear in process listings.
[DATA_EXFILTRATION]: Network operations are restricted to the vendor's official API domain (api.crawlora.net). The script hardcodes the base URL to prevent redirection of sensitive keys to external hosts via environment variables.

google-jobs-research