The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses scripts/crawlora.sh to execute curl commands. The script includes robust security measures, such as restricting requests to the GET method and validating the requested path against a strict allowlist of 119 pre-defined endpoints. It also performs sanitization on query parameters using URL encoding to prevent injection attacks.
[CREDENTIALS_UNSAFE]: The skill requires the user to set a CRAWLORA_API_KEY environment variable. The helper script handles this secret securely by validating its format and writing it to a temporary, restricted-permission configuration file for curl during execution. This ensures the API key does not appear in the system's process tree or command-line history.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crawlora.net. As this infrastructure belongs to the skill's author (crawlora-org), these are legitimate vendor-controlled resources necessary for the skill's primary functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as movie reviews and summaries, which represents a potential attack surface. * Ingestion points: Metadata and review text retrieved from the Crawlora API via scripts/crawlora.sh. * Boundary markers: The skill is documented to return normalized JSON, which helps the agent distinguish data from instructions. * Capability inventory: Capabilities are limited to GET requests against a restricted set of movie-related API endpoints. * Sanitization: The helper script performs strict path validation and URL-encodes all user-provided query arguments.

movie-tv-research