The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses scripts/crawlora.sh to interface with the Crawlora API. The script implements several security best practices, including a strict regex-based allowlist for API paths (lines 50-86), umask 077 and temporary curl config files to prevent API key leakage (lines 91-98), and validation of the CRAWLORA_API_KEY format (lines 14-17).
[EXTERNAL_DOWNLOADS]: Financial data is fetched from https://api.crawlora.net/api/v1. This service belongs to the skill's author (crawlora-org) and is used for the primary function of instrument lookup and market snapshots.
[DATA_EXFILTRATION]: The scripts/crawlora.sh script prevents potential exfiltration via the curl file-upload feature by explicitly rejecting any query arguments containing the @ character (lines 106-108).
[INDIRECT_PROMPT_INJECTION]: The instructions in SKILL.md include mandatory steps to preserve data provenance and explicitly warn against treating market data as live execution signals or automated portfolio actions, mitigating risks associated with processing external financial news.

google-finance-research