The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a helper script, scripts/crawlora.sh, which executes the curl command to interact with the Crawlora REST API. The script uses set -euo pipefail and standard argument parsing for safer execution.
[EXTERNAL_DOWNLOADS]: The skill makes network requests to api.crawlora.net to retrieve product, category, and review data. This is the primary function of the skill and targets the vendor's own infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from a remote API (Wish marketplace data), which is considered untrusted external content. This creates a potential surface for indirect prompt injection attacks where instructions could be hidden in product descriptions or reviews.
Ingestion points: The JSON response from scripts/crawlora.sh is consumed by the agent.
Boundary markers: No explicit delimiters or instructions to ignore embedded commands are provided in the documentation.
Capability inventory: The skill has the ability to execute shell commands (curl) and read environment variables.
Sanitization: The crawlora.sh script employs --data-urlencode to sanitize input parameters, but the content returned by the API is not explicitly sanitized for downstream prompt processing.

wish-research