The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local bash script scripts/crawlora.sh to interact with the Crawlora API. The script is designed with defensive programming practices, including validation of the API key format and the use of a secure temporary configuration file (with restricted permissions and umask) to ensure the API key does not appear in process listings.
[INDIRECT_PROMPT_INJECTION]: The skill acts as a conduit for data from external patent databases (Google Patents and USPTO). This creates a functional surface where third-party content is brought into the agent's context, which is the intended purpose of the skill. The script mitigates common injection vectors by using --data-urlencode for all user-supplied query parameters.
[DATA_EXPOSURE_&_EXFILTRATION]: Network operations are restricted to the vendor's own API domain (api.crawlora.net). The skill instructions correctly advise users to manage secrets using environment variables rather than hardcoding them.

patents-research