The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses curl and node to interact with the XCrawl API. These operations are restricted to the vendor's official domain (https://run.xcrawl.com) and are necessary for the skill's primary function of orchestrating crawl tasks.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external websites during the crawl process.
Ingestion points: External site content is retrieved via the GET /v1/crawl/{crawl_id} endpoint and stored in the data array.
Boundary markers: The skill does not explicitly define prompt delimiters for the ingested content, though it mandates returning raw API responses to the user, which reduces the risk of the agent misinterpreting data as instructions.
Capability inventory: The skill has capabilities for file reading/writing (for config) and network access via curl and node.
Sanitization: No explicit sanitization of the crawled content is mentioned; however, the impact is minimized by the requirement to return raw output rather than processing it into new agent instructions.
[CREDENTIALS_SAFE]: The skill implements a secure practice for API key management by instructing the user to store the XCRAWL_API_KEY in a local configuration file (~/.xcrawl/config.json) rather than hardcoding it or using environment variables.

xcrawl-crawl