The Agent Skills Directory

[COMMAND_EXECUTION]: The skill employs a local helper script (scripts/crawlora.sh) to perform API requests. The script implements several defensive layers:
Strict Input Validation: It verifies that the CRAWLORA_API_KEY environment variable contains only alphanumeric and basic punctuation characters, preventing potential configuration tampering.
Path Sanitization: The script rejects request paths containing special characters (?, #, %), parent directory references (..), or double slashes, effectively preventing path traversal or query smuggling attacks.
Endpoint Allowlisting: A comprehensive allowlist using both exact string matching and anchored regular expressions ensures the script only interacts with a specific set of documented API routes.
[CREDENTIALS_SAFE]: The skill follows security best practices for managing its API key:
Secure Temporary Storage: It uses umask 077 and chmod 600 when creating a temporary curl configuration file, ensuring the key is only readable by the current process owner.
Process Privacy: By passing the API key via a configuration file rather than a command-line header, the skill prevents the secret from appearing in system process lists.
Automatic Cleanup: A shell trap is used to ensure the temporary file is deleted immediately upon script exit, even if the script fails.
[EXTERNAL_DOWNLOADS]: The skill communicates exclusively with the vendor's domain (api.crawlora.net) using HTTPS. It restricts operations to GET requests for public data retrieval and uses --data-urlencode to handle parameters safely.

luxury-resale-research