The Agent Skills Directory

[SAFE]: The skill uses a defensive helper script (scripts/crawlora.sh) that implements a routing whitelist. It restricts API access to a specific set of documented endpoints using case statements and regular expressions, preventing the execution of undocumented or sensitive API routes.
[SAFE]: Credential management follows security best practices. The skill uses the CRAWLORA_API_KEY environment variable rather than hardcoding secrets. The script validates the key format and passes it to curl using a temporary configuration file with restricted permissions (chmod 600), ensuring the key does not appear in process logs and is automatically removed on exit.
[SAFE]: The helper script ensures input safety by using curl's --data-urlencode flag for all query parameters, preventing injection attacks. It also explicitly blocks the @ character in arguments to prevent accidental file disclosure via curl's upload syntax.
[SAFE]: Network activity is locked to the vendor's official API domain (api.crawlora.net) using a hardcoded base URL, which prevents redirection of requests to malicious or unauthorized hosts.

wish-research