The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a shell script (scripts/crawlora.sh) to execute curl commands for API interaction. This script implements multiple defensive layers: it enforces a strict whitelist of allowed API routes and HTTP methods using regex, validates the API key format to prevent shell injection, uses umask 077 and temporary files with 600 permissions to keep credentials out of process listings, and explicitly rejects the @ character in parameters to block curl's local file inclusion capability.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it aggregates data from various external financial platforms. * Ingestion points: Data is retrieved from Yahoo Finance, SEC, CoinGecko, and PitchBook via api.crawlora.net. * Boundary markers: None explicitly provided in the agent instructions. * Capability inventory: The skill uses a curl-based helper script for network requests. * Sanitization: The helper script performs rigorous input validation for requests, but the skill does not include specific logic to sanitize the resulting JSON content for embedded natural language instructions before it is processed by the agent. This is a common characteristic of financial research skills and is managed by standard agent safety guardrails.

finance-markets-research