The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a specialized bash script, scripts/crawlora.sh, to communicate with its API. This script implements several robust security controls:
It restricts operations to the GET method only.
It validates the format of the CRAWLORA_API_KEY to prevent shell injection or configuration file manipulation.
It uses a strict allow-list for API routes, employing both exact matches and regular expressions to ensure only authorized endpoints are accessed.
It employs a secure secret-handling pattern by writing the API key to a temporary curl configuration file with restricted permissions (chmod 600), ensuring the key never appears in the system's process list.
It explicitly prevents file-read vulnerabilities by rejecting the @ character in query parameters, which can sometimes be misused in curl commands to read local files.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external rental housing data from api.crawlora.net.
Ingestion points: Data enters the agent's context through the output of scripts/crawlora.sh.
Boundary markers: The SKILL.md file provides clear instructions on data handling, such as keeping scopes distinct and avoiding inferences about demographics.
Capability inventory: The agent's capabilities are limited to performing read-only GET requests to a predefined set of endpoints.
Sanitization: The helper script performs URL encoding on all query parameters and validates path structures before execution.

rental-housing-research