The Agent Skills Directory

[SAFE]: The skill uses a bash script (scripts/crawlora.sh) to interact with the Crawlora API. This script implements several security best practices:
Input Validation: It validates the format of the API key, the structure of the request path, and query parameters (e.g., rejecting the @ symbol to prevent curl file inclusion attacks).
Route Whitelisting: It strictly limits API calls to a predefined set of allowed Indeed-related endpoints.
Secure Credential Handling: It protects the CRAWLORA_API_KEY by writing it to a temporary, restricted configuration file (chmod 600) used by curl, which prevents the key from appearing in the system's process list.
[EXTERNAL_DOWNLOADS]: The skill communicates with the vendor's official API domain (api.crawlora.net). These requests are restricted to GET operations with properly encoded parameters.

indeed-research