The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local shell script (scripts/crawlora.sh) to perform GET requests to api.crawlora.net. The script implements several defensive measures to prevent exploitation:
Credential Security: It retrieves the CRAWLORA_API_KEY from the environment and passes it to curl using a temporary configuration file (chmod 600) to avoid exposing the secret in the system's process list.
Input Validation: The script validates the API key format against a strict character whitelist and enforces a route allowlist for paths, preventing unauthorized API calls or path traversal.
Parameter Sanitization: It uses curl's --data-urlencode for all query parameters and explicitly blocks the @ character to prevent accidental file inclusion via curl parameters.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from the housing market API to generate reports. While this represents a standard ingestion surface for data-retrieval skills, the risk is minimized as the skill's instructions focus on generating data tables and charts rather than performing sensitive system operations based on the retrieved content.

housing-market-research