The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a helper script (scripts/crawlora.sh) to execute curl commands. It includes robust input validation, restricting paths to a predefined allowlist and preventing parameter injection through URL encoding.
[DATA_EXFILTRATION]: The skill requires an API key (CRAWLORA_API_KEY) for the Crawlora service. It follows security best practices by reading this key from an environment variable and passing it to curl via a temporary configuration file with restricted permissions (chmod 600), ensuring the key does not appear in process listings or command history. It communicates with the vendor's API at api.crawlora.net to fetch research data.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from Kohl's (product listings and reviews) via the Crawlora API. 1. Ingestion points: JSON responses from api.crawlora.net. 2. Boundary markers: The skill instructions specify that the output should be clean JSON. 3. Capability inventory: Network requests via curl in scripts/crawlora.sh. 4. Sanitization: Input parameters are URL-encoded before being used in requests.

kohls-research