The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local bash script scripts/crawlora.sh to perform network operations. This script wraps curl and handles the transmission of the CRAWLORA_API_KEY environment variable as an authentication header.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from H&M catalog entries, specifically customer reviews and product descriptions retrieved via the API.
Ingestion points: Data is fetched from API endpoints described in reference/endpoints.md, particularly the hm_product endpoint which returns customer review bodies.
Boundary markers: The instructions do not specify any delimiters or safety warnings for the agent when interpreting the content of product reviews.
Capability inventory: The skill allows shell command execution through the scripts/crawlora.sh script to perform further API queries.
Sanitization: The helper script correctly uses curl's --data-urlencode for outbound parameters, but there is no explicit filtering applied to the content returned from the API before it enters the agent's context.

hm-research