The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a bundled bash script, scripts/crawlora.sh, to communicate with the Crawlora API. This script follows security best practices: it uses umask 077 and chmod 600 for temporary files, prevents API key leakage on the command line by using curl configuration files, and strictly validates the API key format to prevent injection attacks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external content from Substack (titles, metadata, and snippets). While this represents a potential injection surface, the skill instructions explicitly direct the agent to treat this content as evidence for coding/labeling, to lower claim specificity if only partial data is available, and to refrain from autonomous actions like subscribing or contacting authors based on the data.
[SAFE]: All network operations are hardcoded to the vendor's official domain (api.crawlora.net). The script implements a strict path whitelist (e.g., /substack/search, /substack/publication/posts) and restricts operations to HTTP GET only, effectively preventing unauthorized API actions. No obfuscation, persistence mechanisms, or privilege escalation patterns were found.

newsletter-topic-landscape