The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a local bash script scripts/crawlora.sh to interact with the Crawlora API. The script includes multiple layers of validation: it restricts requests to the GET method, validates the API key format, enforces a strict whitelist of allowed API routes using regular expressions, and prevents path traversal or shell injection by checking for suspicious characters in the path and query arguments.
[DATA_EXFILTRATION]: The skill communicates with an external API service at api.crawlora.net. This is the intended behavior of the skill provided by the vendor crawlora-org. The API key is managed via an environment variable and passed to curl using a temporary configuration file with restricted permissions (chmod 600), which prevents the secret from appearing in the process list or being readable by other users on the system.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Reddit posts and comments. While this introduces a potential attack surface for indirect prompt injection, the skill's instructions focus on classification and summarization, and its technical capabilities are limited to making read-only GET requests to a specific, validated set of API endpoints. There are no capabilities for arbitrary file writes, code execution, or network requests to other domains.

reddit-stock-sentiment-research