The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local helper script (scripts/crawlora.sh) to interact with the Crawlora API. The script implements several security best practices:
Credential Protection: It uses a temporary, restricted-permission configuration file (mktemp, chmod 600) to pass the API key to curl via a header, which prevents the key from appearing in system process lists.
Input Validation: The CRAWLORA_API_KEY is validated against a strict character set to prevent shell injection or configuration manipulation.
Path Whitelisting: It enforces a strict whitelist of allowed API endpoints and associated HTTP methods, preventing the agent from calling unauthorized routes.
Local File Protection: The script explicitly rejects the @ character in query arguments and uses piped input for POST bodies to prevent curl from accidentally reading or disclosing local system files.
[DATA_EXFILTRATION]: Network operations are restricted to the vendor's official API domain (api.crawlora.net). No sensitive local files are accessed or transmitted.

google-trends-research