The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bundled helper script (scripts/crawlora.sh) to perform REST API calls. This script is defensively written, featuring strict alphanumeric validation for the API key and regex-based whitelisting for path parameters to prevent injection attacks and access to unauthorized endpoints.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to https://api.crawlora.net, which is the official API domain for the vendor (crawlora-org). This connectivity is necessary for the skill's stated purpose of fetching NFT market data and does not pose a security risk.
[INDIRECT_PROMPT_INJECTION]: The skill processes data fetched from external NFT marketplaces. Although this is a data ingestion point, the skill only performs read-only operations and lacks capabilities (like file writes or arbitrary execution) that would make it vulnerable to indirect prompt injection.
[SAFE]: The skill handles an API key provided by the user via environment variables. The implementation follows security best practices by using a restricted temporary configuration file for curl (umask 077, chmod 600) to ensure the secret is not exposed in process lists and is automatically cleaned up after the script executes.

nft-collection-liquidity-research