The Agent Skills Directory

[SAFE]: The bundled shell script scripts/crawlora.sh implements several security best practices for handling sensitive information. It avoids passing the API key as a command-line argument, which would be visible in process listings, by using a temporary configuration file with restricted permissions (chmod 600) that is automatically removed on exit.
[COMMAND_EXECUTION]: The skill uses a bash helper script to interact with the Crawlora REST API. This script includes rigorous input validation, such as checking the API key format, restricting allowed HTTP methods to GET, and enforcing a strict allow-list for API routes and regex-based path matching to prevent unauthorized access or command injection.
[EXTERNAL_DOWNLOADS]: The skill fetches Steam market data, game metadata, and news from api.crawlora.net. These network operations are limited to the vendor's official API infrastructure and are used solely for the skill's primary research purpose.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data, such as Steam user reviews and news announcements, via the Crawlora API.
Ingestion points: Data is retrieved through scripts/crawlora.sh from various dataset and Steam endpoints, including /steam/reviews and /steam/news.
Boundary markers: The instructions provide logical guidance for data separation but do not use explicit delimiters or "ignore instructions" directives for the ingested content.
Capability inventory: The agent can execute the local crawlora.sh script and perform file operations within the skill's directory.
Sanitization: The helper script URL-encodes query parameters and validates paths to prevent injection at the transport level, but the raw text content of reviews and news is processed by the agent without specific sanitization of its content.

steam-market-opportunity-research