The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/crawlora.sh helper script facilitates secure network requests to the Crawlora API with multiple defensive layers:
Path Whitelisting: The script enforces a strict whitelist of SEC-related API routes and specific HTTP methods, preventing the agent from calling unauthorized endpoints.
Secure Credential Handling: The CRAWLORA_API_KEY is passed to curl via a temporary configuration file with restricted permissions (600) and a trap for cleanup, ensuring the key never appears in the system process list.
Input Sanitization: The script validates the API key format and uses curl's --data-urlencode feature and stdin streaming to prevent local file disclosure attacks (exploiting the @ syntax) and shell injection.
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill follows safe practices for secret management. It does not contain hardcoded credentials and correctly instructs the user to provide an API key via an environment variable.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content from SEC filings and web pages.
Ingestion points: API responses from scripts/crawlora.sh containing filing text and scraped web content.
Boundary markers: The instructions guide the agent to distinguish management statements from facts, though technical delimiters are not explicitly used for data isolation.
Capability inventory: The skill is capable of network requests, but these are restricted to the vendor's API by the helper script.
Sanitization: While the script ensures secure transport, the content of the filings is processed as raw text, which is an inherent property of the skill's purpose.

sec-filings-research