The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local bash script (scripts/crawlora.sh) to perform API requests. The script is highly defensive, employing set -euo pipefail, strictly validating the API key format, and using a route allowlist with regular expressions to prevent unauthorized path traversal or execution of unintended API endpoints.
[EXTERNAL_DOWNLOADS]: Retrieves financial data and SEC filings from the vendor's API at api.crawlora.net. These operations are central to the skill's purpose. The script uses temporary curl configuration files to ensure the API key is passed securely in headers rather than appearing in the process command line.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external financial sources. While this involves ingesting untrusted content, the skill does not possess high-privilege capabilities (such as arbitrary file writing or system command execution) that would allow for exploitation via prompt injection. The risk is minimized by the skill's specific focus on generating financial briefs.
[CREDENTIALS_UNSAFE]: The skill follows security best practices for secret management by instructing users to store the CRAWLORA_API_KEY in the environment rather than hardcoding it, and it validates the key's format before use to prevent injection into the helper script's temporary files.

earnings-event-research