The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a bash helper script scripts/crawlora.sh to facilitate API requests. The script implements multiple layers of defensive security: it enforces a strict whitelist of allowed API routes and HTTP methods using regex validation, rejects potentially malicious path characters (e.g., directory traversal or shell globs), and uses curl safely by ignoring user-level configuration files and preventing the interpretation of arguments as local file paths via the @ prefix.
[CREDENTIALS_UNSAFE]: The skill requires a CRAWLORA_API_KEY provided via the environment. The helper script manages this secret securely by writing it to a temporary file with restricted permissions (chmod 600) and passing it to curl using the --config flag. This practice ensures the API key does not appear in process listings or command-line history.
[EXTERNAL_DOWNLOADS]: The skill communicates with the vendor's official API at api.crawlora.net. This is the intended primary purpose of the skill and involves only public, read-only market data.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external forecasting platforms. While this represents a theoretical ingestion surface for indirect prompt injection, the skill's capabilities are strictly limited to network requests against a whitelist of endpoints and returning structured JSON. The helper script does not possess capabilities to write to the filesystem or execute arbitrary system commands based on the ingested data.

prediction-markets-research