The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a bash script scripts/crawlora.sh to interface with the Crawlora API.
The script implements strict input validation, including character-set checks for the API key and a whitelist for allowed API paths.
API keys are handled securely using a temporary curl configuration file with restricted permissions (chmod 600), preventing exposure in process listings.
Query parameters are URL-encoded via curl -G --data-urlencode to prevent command or argument injection attacks.
[SAFE]: All external network requests are directed to the vendor's own API endpoint (api.crawlora.net), which is consistent with the skill's purpose and the developer's identity.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from ticketing platforms via the Crawlora API.
Ingestion points: Data enters via the crawlora.sh script output during API calls to SeatGeek and StubHub.
Boundary markers: The skill instructions in SKILL.md specify a strict reporting format (dated snapshot table), which helps the agent maintain structural context.
Capability inventory: The skill provides network access via curl in crawlora.sh, but this is limited to GET requests on a whitelisted set of paths.
Sanitization: The processing script sanitizes input arguments using URL-encoding.

live-events-ticketing-research