The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Bash helper script (scripts/crawlora.sh) to interface with the Crawlora API. The script is highly restrictive and secure:
[CREDENTIALS_SAFE]: It correctly handles the CRAWLORA_API_KEY by reading it from the environment and writing it to a temporary, mode-600 configuration file (mktemp). This prevents the key from appearing in the process tree (e.g., via ps) or shell history.
[INPUT_VALIDATION]: The script implements robust input validation for both the API key and the requested paths. It uses character allowlisting for the key and regex-based path validation to ensure only documented, safe LinkedIn routes can be called. It specifically blocks character sequences like .., //, ?, #, and % in the path to prevent traversal or smuggling attacks.
[LEAST_PRIVILEGE]: The script is hardcoded to only perform GET requests to a single base URL (https://api.crawlora.net/api/v1), preventing redirection to malicious domains or unauthorized state-changing operations (POST/DELETE).
[DATA_EXFILTRATION]: No sensitive local data is accessed or sent externally. The network communication is limited to a well-known service provider (Crawlora) for its intended research purpose.

linkedin-research