The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a shell script (scripts/crawlora.sh) to interact with the Crawlora API. The script implements several defensive programming measures to ensure security:
[CREDENTIAL_PROTECTION]: It specifically checks the format of the CRAWLORA_API_KEY environment variable to prevent injection attacks and uses a temporary curl configuration file (via mktemp and chmod 600) to pass the API key to the header, preventing it from appearing in process listings.
[PATH_VALIDATION]: It utilizes anchored regular expression matching and a whitelist to ensure only documented API routes can be accessed, preventing the agent from being tricked into calling administrative or unrelated API endpoints.
[INPUT_SANITIZATION]: It rejects paths containing characters like ?, #, %, or .. to prevent path traversal or query smuggling, and it uses --data-urlencode for all query parameters to ensure user-supplied data is safely handled by curl.

youtube-research