The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a specialized helper script scripts/crawlora.sh to perform API requests. This script implements several security best practices, including:
Restricting operations to the GET method only.
Validating the API key format to prevent shell injection or configuration file manipulation.
Using a strict allowlist for API paths to ensure only documented Target research endpoints are accessible.
Sanitizing query parameters by rejecting specific characters like @ that could be used to trigger unintended curl behaviors.
[CREDENTIALS_UNSAFE]: The skill follows secure practices for sensitive data management. It requires the CRAWLORA_API_KEY to be set in the environment and handles it securely by writing it to a temporary curl configuration file with restricted permissions (chmod 600). This prevents the API key from being exposed in process listings (e.g., via ps) or command-line history.
[DATA_EXFILTRATION]: Network communication is strictly limited to the vendor's official API base URL (https://api.crawlora.net/api/v1). The skill does not attempt to access local sensitive files, system configurations, or user credentials.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from Target's catalog (product details, reviews, etc.). While this is an entry point for untrusted data, the skill's restricted capabilities (read-only access to a specific API) and lack of persistent storage or administrative commands mitigate the risk of exploitation.

target-research