The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a bash script to perform API requests to the vendor's infrastructure.
Evidence: scripts/crawlora.sh executes curl to query https://api.crawlora.net/api/v1.
Mitigations: The script includes defensive checks such as whitelisting specific API routes using regular expressions, validating the API key format to prevent header injection, and using a temporary configuration file to keep secrets out of the process command line.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes data from external platforms, which could contain instructions intended to influence the agent.
Ingestion points: Market data is fetched from the Crawlora API at api.crawlora.net for Polymarket, Kalshi, and Metaculus.
Boundary markers: There are no explicit delimiters or system instructions to the agent to treat the fetched JSON as untrusted content.
Capability inventory: The skill has shell execution capability via the provided scripts/crawlora.sh helper.
Sanitization: The whitelisting logic in the helper script limits the agent's network interaction to a predefined set of safe endpoints.

forecast-consensus-comparison