The Agent Skills Directory

[COMMAND_EXECUTION]: The skill employs a bash script scripts/crawlora.sh to handle API communications with high security standards:
Secret Protection: It prevents the CRAWLORA_API_KEY from appearing in process lists by using a temporary curl configuration file (created with mktemp and umask 077) rather than passing it as a command-line argument. The file is automatically deleted on exit via a trap command.
Input Validation: The script performs strict character validation on the API key and uses regular expressions to allowlist only specific, documented API paths, which prevents arbitrary command execution or path traversal.
Argument Sanitization: It uses curl --data-urlencode to handle parameters safely and explicitly rejects the @ character in query arguments to block local file inclusion attacks.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crawlora.net to retrieve product data. This activity is restricted to the vendor's official API endpoints and is central to the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill ingests product data (titles, descriptions, and ratings) from an external catalog. While this data could theoretically contain instructions intended for the agent, the risk is managed by processing the data as structured JSON.
Ingestion points: Data enters the system via the scripts/crawlora.sh helper from the Crawlora API.
Capability inventory: The agent uses local scripts for network access and JSON parsing.
Boundary markers: No explicit instructions are present to warn the agent about untrusted content in the product data.
Sanitization: Input parameters are URL-encoded by the helper script, and the output is received in structured JSON format.

samsclub-research