The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local helper script scripts/crawlora.sh to interact with the Crawlora API. This script includes several security best practices: it validates the API key format to prevent environment injection, restricts API paths to a predefined allowlist using regex and case matching, and sanitizes query parameters by rejecting the @ symbol to prevent curl from accidentally disclosing local files.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crawlora.net. These operations are directed at the official API infrastructure of the skill's vendor and are necessary for retrieving TikTok creator profile and engagement data.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-generated content from TikTok, including bios, nicknames, and comments.
Ingestion points: Data retrieved from the /tiktok/profile, /tiktok/posts, and /tiktok/comments endpoints is returned to the agent context for analysis and shortlist generation.
Boundary markers: The SKILL.md instructions advise the agent to verify the API response envelope and application codes, although specific delimiters for the ingested text are not mandated.
Capability inventory: The skill provides access to a shell script that executes network requests and writes JSON data to the standard output for the agent to read.
Sanitization: The helper script ensures that input parameters passed to the API conform to expected path structures and do not exploit shell or curl features to access local data.

tiktok-creator-research