The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a helper script (scripts/crawlora.sh) to perform API calls. This script is designed with security best practices, such as setting umask 077, using temporary files for API keys to avoid command-line exposure, and enforcing a strict whitelist of allowed API endpoints and methods.- [EXTERNAL_DOWNLOADS]: The skill fetches music and podcast metadata from api.crawlora.net. These network operations are limited to the vendor's official API and are used solely for the skill's stated purpose of music and podcast research.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from third-party sources (Spotify, Apple Podcasts, etc.) via the Crawlora API. This represents a potential surface for indirect prompt injection if external content contains malicious instructions, though the risk is minimized by the use of structured JSON data and strict script-level validation.
Ingestion points: Data is ingested from the Crawlora API through the scripts/crawlora.sh script.
Boundary markers: The skill does not define specific delimiters to separate API responses from instructions in the agent context.
Capability inventory: The skill has network access capabilities through curl within the scripts/crawlora.sh helper script.
Sanitization: The helper script performs rigorous path validation and uses URL encoding for parameters to prevent exploitation of the underlying curl command.

music-podcast-research