The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a helper script scripts/crawlora.sh to execute curl commands. The script includes robust security measures to prevent command injection, such as:
Strict validation of the CRAWLORA_API_KEY using character allowlists.
Hardcoded API base URL to prevent redirection to malicious hosts.
Regex-based path allowlisting to ensure only documented routes are accessed.
Use of curl --data-urlencode for query parameters to prevent argument injection.
[EXTERNAL_DOWNLOADS]: The skill fetches data from api.crawlora.net. This is the core functionality of the skill, and the domain belongs to the vendor (crawlora-org). These are legitimate API requests to a known service associated with the skill author.
[CREDENTIALS_UNSAFE]: The skill correctly instructs users to store API keys in environment variables (CRAWLORA_API_KEY) rather than hardcoding them. The helper script uses a secure temporary file with restricted permissions (chmod 600) to pass the key to curl via a config file, preventing the key from appearing in the process tree (e.g., via ps).
[NO_CODE]: The skill primarily consists of instructional markdown and a wrapper script for API calls, with no complex logic or dynamic execution patterns that would introduce typical code-based vulnerabilities.

upwork-research