The Agent Skills Directory

Unverifiable Dependencies & Remote Code Execution (SAFE): The skill provides installation instructions via npx skills add from a GitHub repository and clawhub. While these are external sources, the provided script logic is static and does not involve the dynamic execution of remote content at runtime.
Command Execution (SAFE): The shell script uses curl to interact with the Camino AI API and jq for JSON processing. These commands are used for their intended purposes and are common in agent skills.
Data Exposure & Exfiltration (SAFE): The skill transmits search parameters to api.getcamino.ai. This is the primary function of the skill. It requires an API key via an environment variable (CAMINO_API_KEY) and does not attempt to access sensitive local files like SSH keys or AWS credentials.
Indirect Prompt Injection (LOW): The skill ingests user-provided queries to search for parking.
Ingestion points: The query parameter within the JSON input to parking-finder.sh.
Boundary markers: None explicitly present in the script.
Capability inventory: Uses curl to make network requests.
Sanitization: The script uses jq's @uri filter to properly URL-encode the user input before it is interpolated into the API request, which prevents the input from breaking out of the query string and manipulating the HTTP request structure.

parking-finder