The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local bash script (scripts/crawlora.sh) to interact with the Crawlora API. The script is designed with several security layers: 1) Path validation using a strict whitelist and regular expressions to ensure only approved API routes are accessed; 2) Parameter safety using curl with --data-urlencode to prevent injection and blocking the @ character to prevent unauthorized file reading; 3) Credential protection via a temporary configuration file with restricted permissions (chmod 600) to avoid exposure in process lists.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (TikTok, Instagram, YouTube, and Substack) that could contain malicious instructions. Ingestion points include influencer bios, nicknames, and post content retrieved via API endpoints. Boundary markers are not explicitly defined in the instructions to separate untrusted content from system prompts. The agent maintains the capability to execute shell commands through the crawlora.sh script for further requests, although the script performs sanitization via URL encoding and path whitelisting.

influencer-discovery