The Agent Skills Directory

[SAFE]: The skill uses a helper script (scripts/crawlora.sh) to interact with the vendor's official API at api.crawlora.net. The script follows security best practices by using environment variables for API keys rather than hardcoding credentials.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crawlora.net, which is the official domain for the skill author 'crawlora-org'. These requests are for the primary purpose of the skill (fetching product data) and do not involve untrusted or risky external sources.
[COMMAND_EXECUTION]: The shell script uses curl to make API calls and jq for JSON processing. These are standard tools for CLI-based data retrieval and do not execute untrusted commands or scripts.
[DATA_EXFILTRATION]: No evidence of sensitive data access (like SSH keys or AWS credentials) or exfiltration was found. The skill only handles public Walmart product data retrieved via the API.
[PROMPT_INJECTION]: The instructions in SKILL.md are descriptive and provide clear guidance for the agent without attempting to bypass safety filters or override system instructions.

walmart-research