The Agent Skills Directory

[SAFE]: The core tool scripts/crawlora.sh uses defensive programming techniques to prevent command injection and unauthorized API usage. It validates the format of the CRAWLORA_API_KEY and enforces a strict whitelist of allowed Flashscore API paths.
[SAFE]: The skill handles sensitive credentials securely. The API key is written to a temporary configuration file with restricted permissions (chmod 600) and passed to curl via the --config option, ensuring the secret never appears in the system's process listings.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to api.crawlora.net to retrieve sports data. This domain is owned by the vendor crawlora-org and is used as intended for data retrieval.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (sports news, profiles, and results) which could theoretically contain malicious instructions.
Ingestion points: External data enters the agent context through the output of scripts/crawlora.sh.
Boundary markers: Absent. The skill does not explicitly wrap tool output in delimiters or provide "ignore embedded instructions" warnings.
Capability inventory: The skill uses the Bash tool to execute scripts/crawlora.sh, which performs network operations via curl.
Sanitization: Input parameters are sanitized using --data-urlencode, and path access is restricted to a hardcoded whitelist of safe API routes.

sports-team-player-research