The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bash helper script (scripts/crawlora.sh) to execute curl commands against the Crawlora API. The script implements defensive coding practices, including strict allowlisting of API paths and methods, verification of the API key format, and use of a fixed base URL to prevent redirection attacks.
[EXTERNAL_DOWNLOADS]: The skill communicates with the Crawlora API (api.crawlora.net) to fetch business data. The helper script manages the CRAWLORA_API_KEY securely by writing it to a temporary configuration file with restricted (mode 600) permissions and ensuring it is deleted upon script termination.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes third-party business data (categories, reviews, and names) from Google Maps, Apple Maps, and Yelp. While this constitutes an attack surface for indirect prompt injection, the skill mitigates risk by instructing the agent to treat data as "evidence" for comparison rather than instructions, and providing structured workflows for data reconciliation.
Ingestion points: Data enters the context from the Crawlora API via endpoints like /google/map/search and /apple-maps/search as documented in reference/endpoints.md.
Boundary markers: Results are structured as JSON and the skill instructions categorize data as evidence for a coverage ledger and business matrix.
Capability inventory: The agent can execute the crawlora.sh script to perform network requests and write reports to the filesystem.
Sanitization: The helper script validates paths and prevents local file disclosure (LFD) by blocking the @ character in query parameters and streaming POST bodies via stdin to prevent curl from interpreting values as local file references.

local-competitive-landscape