The Agent Skills Directory

[COMMAND_EXECUTION]: The skill employs a bash helper script (scripts/crawlora.sh) that demonstrates a strong security posture. It mitigates command injection and credential exposure by:
Restricting the CRAWLORA_API_KEY to an alphanumeric format.
Using a temporary curl configuration file with restricted permissions (600) to pass credentials, ensuring the API key never appears in cleartext in process listings.
Forcing the request method to GET and explicitly rejecting flags that could modify the request structure.
Implementing a strict whitelist of allowed API routes using anchored regular expressions, preventing access to unauthorized endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources like Product Hunt and Kickstarter. While this creates a theoretical injection surface, the skill provides explicit instructions to treat source data as evidence for hypotheses rather than authoritative commands. The helper script further secures this surface by URL-encoding all parameters and blocking the @ character to prevent unauthorized file access via curl's file upload features.
[DATA_EXFILTRATION]: Network operations are restricted to the vendor's official API domain (api.crawlora.net). The script uses a hardcoded base URL to prevent redirection of sensitive API keys to attacker-controlled infrastructure.

startup-launch-research