The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a shell script scripts/crawlora.sh to interact with an external API. The script implements multiple security best practices to prevent command injection and unauthorized usage:
Validates the CRAWLORA_API_KEY format using a strict alphanumeric character check, preventing the injection of shell control characters or config file directives.
Uses a fixed, hardcoded base URL to prevent redirection of sensitive API keys to malicious hosts.
Implements a strict route whitelist (e.g., /googlepatents/search, /usptoppubs/detail), rejecting any path not explicitly defined for this skill's scope.
Protects against local file inclusion/shorthand attacks by rejecting the @ symbol in query arguments.
Safely handles the API key by writing it to a temporary, restricted-permission (chmod 600) curl configuration file rather than passing it via command-line arguments.
[DATA_EXFILTRATION]: Network operations are restricted to the vendor's official API domain (api.crawlora.net). There are no patterns suggesting the exfiltration of user files or environment secrets beyond the intended CRAWLORA_API_KEY used for authentication.
[PROMPT_INJECTION]: The instructions in SKILL.md focus on methodological rigor (assignee normalization, family grouping) and do not contain attempts to override agent safety guidelines or extract system prompts.
[EXTERNAL_DOWNLOADS]: No external code or packages are downloaded at runtime. The skill relies on standard system curl and the provided local shell script.

patent-landscape-analysis