The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests vehicle listing data from third-party sources (CarMax, Autotrader, Cars.com) via an API for comparison and analysis. This external content could theoretically contain instructions intended to influence the agent's behavior during the comparison process.
Ingestion points: External data is retrieved through the scripts/crawlora.sh helper script from api.crawlora.net.
Boundary markers: The instructions do not define specific delimiters to isolate the external listing data from the agent's analytical instructions.
Capability inventory: The skill is capable of executing network requests via curl through the provided script, but lacks file-system write or persistent execution capabilities.
Sanitization: The helper script performs basic path validation and uses curl's parameter encoding to mitigate command injection risks.
[COMMAND_EXECUTION]: The skill uses a local bash script (scripts/crawlora.sh) to perform API calls. The script incorporates security-focused design elements:
Credential Protection: It uses mktemp and a curl config file to provide the API key via a header, preventing the secret from appearing in process listings or command history.
Input Validation: It enforces strict format checks on the CRAWLORA_API_KEY and uses a whitelist of allowed API routes via regex matching to prevent unauthorized path traversal or usage of unrelated API endpoints.

used-car-market-comparison