The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/crawlora.sh script executes curl to interact with the Crawlora API. It includes robust security measures for handling the CRAWLORA_API_KEY, such as using a temporary configuration file with restricted permissions (umask 077, chmod 600) and validating that the key contains only alphanumeric characters to prevent injection.
[EXTERNAL_DOWNLOADS]: The skill fetches podcast metadata from https://api.crawlora.net/api/v1. This is a vendor-owned service associated with the skill's author (crawlora-org) and is used for its intended research purpose. The script enforces a strict allowlist of API routes using shell case patterns and regular expressions, preventing the agent from accessing unauthorized endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted podcast metadata, such as show notes and descriptions. The instructions include a specific warning to distinguish source claims from independently corroborated facts, which serves as a safety boundary for the agent when interpreting external content.

podcast-discovery-research