The Agent Skills Directory

[SAFE]: The skill employs secure credential management by passing the CRAWLORA_API_KEY through a temporary curl configuration file. This practice ensures the key is never exposed in command-line arguments or system process listings.
[SAFE]: The scripts/crawlora.sh helper script includes strict input validation to prevent common command and path injection attacks. It explicitly rejects suspicious path characters (like .., //, or %) and disallows the use of the @ character in query parameters to prevent unauthorized local file disclosure through curl's file-loading feature.
[SAFE]: API access is strictly limited to an allow-list of specific GoodRx and web retrieval endpoints. The script enforces correct HTTP methods (GET/POST) for each route, preventing the use of the helper for unintended API operations.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external web sources (GoodRx, FDA, NIH). This ingestion represents a surface for indirect prompt injection. However, the skill includes explicit instructions for the agent to separate source content from summaries, attribute all data, and cross-check claims against official domains, which effectively mitigates the risk of the agent obeying instructions embedded in the retrieved medical data.

medication-information-research