The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses shell execution to call curl, but implements extensive security measures to prevent command injection. It uses an allow-list of known API routes and rejects any path containing special characters like ?, #, %, or .. that could be used for injection or traversal.
[CREDENTIALS_UNSAFE]: The skill requires a CRAWLORA_API_KEY environment variable. It securely passes this key to curl using a temporary configuration file created with mktemp and restricted permissions (chmod 600), ensuring the secret never appears in process listings (e.g., ps aux). The key is also validated against a strict character set (alphanumeric and ._-) before use.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crawlora.net, which is the official API endpoint for the vendor 'crawlora-org'. This is consistent with the skill's primary purpose and uses standard, non-obfuscated HTTPS communication.
[DATA_EXFILTRATION]: No evidence of data exfiltration was found. The skill only performs GET requests to a fixed base URL and does not read sensitive local files (like .ssh or .aws) or environment variables other than its own required API key.
[INDIRECT_PROMPT_INJECTION]: The skill processes external news content which is untrusted data. However, it returns the content as clean, normalized JSON to the agent, providing a structured boundary. The instructions also warn the agent to quote sparingly and link original sources, reducing the risk of the agent accidentally executing instructions embedded in news articles.

news-media-research