The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources including ImportYeti reports, Bing search results, and scraped web content.\n
Ingestion points: Untrusted data enters through scripts/crawlora.sh calling endpoints like /importyeti/search, /bing/search, and /web/scrape.\n
Boundary markers: Not present. The instructions lack specific delimiters or warnings to ignore instructions embedded in the retrieved data.\n
Capability inventory: scripts/crawlora.sh executes network operations to api.crawlora.net.\n
Sanitization: None specified in the instructions for processing external content.\n- [COMMAND_EXECUTION]: The skill utilizes a bundled shell script for API interaction.\n
Evidence: SKILL.md directs the agent to execute scripts/crawlora.sh.\n
Security Controls: The script includes robust security measures, such as a strict route allowlist, method enforcement, and secure API key handling via temporary files to prevent credential leakage in process lists.\n- [EXTERNAL_DOWNLOADS]: The skill makes network requests to a remote API service.\n
Evidence: Requests are sent to https://api.crawlora.net/api/v1. This domain is an official resource for the skill's vendor.

supplier-sourcing-research