The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches product catalog data and reviews from api.crawlora.net. This domain is the official API endpoint for the skill author.
[COMMAND_EXECUTION]: A bash helper script (scripts/crawlora.sh) manages API interactions. It contains security checks to validate the API key's character set and restricts requests to a specific allowlist of paths.
[INDIRECT_PROMPT_INJECTION]: The skill processes product data and customer reviews which could contain external instructions.
1. Ingestion points: Untrusted data enters the context through the /oldnavy/product/reviews and /oldnavy/category API responses.
1. Boundary markers: The API returns structured JSON data; no explicit prompt boundary markers are defined in the instructions.
1. Capability inventory: The skill's capabilities are limited to performing network GET requests via a restricted helper script; it has no access to sensitive files or arbitrary command execution.
1. Sanitization: The helper script uses curl --data-urlencode to sanitize query parameters provided to the API.

oldnavy-research