The Agent Skills Directory

[SAFE]: The helper script scripts/crawlora.sh implements significant security hardening. It restricts requests to a hardcoded vendor API endpoint and uses a strict allowlist for API paths to prevent unauthorized access. It also securely manages the API key by using a temporary, restricted-permission file, ensuring the secret is never exposed in process lists.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted catalog data via the Crawlora API (scripts/crawlora.sh). While no explicit boundary markers or sanitization routines are defined in the instructions, the skill's capability inventory is restricted to simple data retrieval via HTTP GET, with no access to dangerous functions like file writing or arbitrary command execution based on the ingested content.
[SAFE]: No malicious patterns such as obfuscation, persistence mechanisms, or unauthorized privilege escalation were identified. All external resource references are consistent with the vendor's identity.

zara-research