The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were identified. The skill follows security best practices for external API integration.
[CREDENTIALS_UNSAFE]: The skill manages the CRAWLORA_API_KEY through environment variables. The helper script scripts/crawlora.sh securely handles this key by writing it to a temporary configuration file with restricted permissions (chmod 600) and utilizing the curl --config flag. This prevents the API key from being exposed in process listings or command history.
[COMMAND_EXECUTION]: The skill relies on scripts/crawlora.sh to facilitate API requests. This script includes significant defensive measures: it uses set -euo pipefail, validates the API key format to prevent injection, hardcodes the base URL to prevent redirection, and implements an extensive allowlist for API paths using both shell case patterns and regular expressions.
[EXTERNAL_DOWNLOADS]: The skill communicates with api.crawlora.net. This domain is an official resource owned by the skill's author, crawlora-org, and is used as intended for data retrieval.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON data from third-party storefronts via the Crawlora API.
Ingestion points: External storefront data is ingested as JSON via the Crawlora API in scripts/crawlora.sh.
Boundary markers: The SKILL.md instructions specify the tool returns normalized JSON and clean text.
Capability inventory: The skill has the capability to execute the crawlora.sh script and make network requests via curl.
Sanitization: Inputs are sanitized using curl --data-urlencode within the helper script to prevent injection into the API query string.

shopify-research