The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches healthcare provider directory information from the vendor's API at https://api.crawlora.net/api/v1.
[COMMAND_EXECUTION]: The skill uses a helper script, scripts/crawlora.sh, to make API calls. This script includes several security controls:
Input Sanitization: It validates the CRAWLORA_API_KEY format and rejects query arguments containing @ to prevent unauthorized file access via curl.
Path Whitelisting: It enforces a strict whitelist of allowed API routes, preventing access to unauthorized endpoints.
Credential Protection: It uses a temporary curl configuration file with restricted permissions (chmod 600) to pass the API key, ensuring the key does not appear in the system's process list.
Request Restriction: It limits operations to GET requests only, as required for its research purpose.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and summarize external data from Healthgrades records, which represents a potential surface for indirect instructions.
Ingestion points: Data is retrieved from the Crawlora API via scripts/crawlora.sh.
Boundary markers: The skill instructions emphasize treating directory labels and reviews as evidence for inspection rather than clinical recommendations, and require maintaining source attribution.
Capability inventory: Execution is limited to a shell script that performs specific GET requests to the vendor's domain.
Sanitization: The helper script implements path sanitization and URL-encoding for all parameters.

health-provider-research