The Agent Skills Directory

[SAFE]: The bundled helper script (scripts/crawlora.sh) used to interact with the Crawlora API implements extensive security controls. It masks the API key using a temporary configuration file to prevent exposure in process lists, uses umask 077 for file privacy, and validates all paths and HTTP methods against an allowlist.
[SAFE]: The script protects against local file inclusion and command injection by rejecting the @ character in query parameters and using curl's --data-binary @- syntax to stream request bodies rather than interpreting them as file paths.
[EXTERNAL_DOWNLOADS]: The skill fetches labor market data from the vendor's official API at api.crawlora.net. This is the intended primary purpose of the skill and does not involve downloading executable code.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an ingestion surface for external data.
Ingestion points: Job posting data is fetched via scripts/crawlora.sh from the Crawlora dataset endpoints.
Boundary markers: None explicitly defined in the prompts, though the skill provides detailed guidance for the agent on how to interpret and classify mentions within the data.
Capability inventory: The skill can execute the crawlora.sh script to perform network operations and process the resulting JSON data.
Sanitization: The helper script provides robust sanitization of query parameters and request bodies to prevent command injection and unauthorized file access.

hiring-demand-analysis