The Agent Skills Directory

[SAFE]: The skill follows security best practices for external API interaction and credential management.
[COMMAND_EXECUTION]: The skill utilizes a local bash helper (scripts/crawlora.sh) to perform network requests. The script contains several robust security controls:
Strict Path Allowlisting: It uses anchored regular expressions (e.g., ^/reddit/comments/[^/]+$) and a static allowlist to ensure only documented Reddit endpoints can be called.
Input Validation: It rejects malicious path characters (e.g., .., //, ?, #) and validates the CRAWLORA_API_KEY format to prevent command or header injection.
Secure Credential Handling: The API key is passed to curl via a temporary configuration file with restricted permissions (chmod 600), created with umask 077, and automatically deleted on exit. This prevents the key from appearing in the process list.
Parameter Sanitization: All user-supplied query parameters are processed via curl --data-urlencode to prevent injection and ensure safe handling of special characters.
[EXTERNAL_DOWNLOADS]: The skill connects to api.crawlora.net to retrieve Reddit data. This domain belongs to the skill's vendor and all communication is performed over HTTPS.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from Reddit (posts and comments), which is a common surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through the JSON responses of the crawlora.sh tool.
Boundary markers: The instructions do not specify explicit delimiters for the retrieved Reddit content.
Capability inventory: The agent can execute the restricted crawlora.sh script.
Sanitization: While outgoing parameters are URL-encoded, the incoming data is passed to the agent as raw JSON for processing.

reddit-research