The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bash script (scripts/crawlora.sh) to interface with an external API. The script includes several defensive measures against command injection:
Strict validation of the CRAWLORA_API_KEY format.
A whitelist of allowed API routes and HTTP methods.
Use of regex anchors to prevent path traversal or parameter smuggling.
Rejection of special characters like @ in query arguments to prevent local file disclosure through curl.
Passing the request body via stdin to prevent curl from interpreting user input as local file references.
[CREDENTIALS_UNSAFE]: The skill correctly handles the CRAWLORA_API_KEY by requiring it in the environment rather than hardcoding it. It further protects the key by writing it to a temporary curl configuration file with restricted permissions (chmod 600) and ensuring the file is removed upon exit, preventing the secret from appearing in process lists (e.g., ps aux).
[EXTERNAL_DOWNLOADS]: The skill communicates with a known service (api.crawlora.net). These network operations are intrinsic to the skill's stated purpose of providing Google Maps data and are performed using a hardcoded base URL, preventing redirection to malicious hosts.

google-maps-research