The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill securely manages the CRAWLORA_API_KEY by utilizing a temporary configuration file with restricted filesystem permissions (chmod 600). This method ensures the API key is passed to the network client without exposing it in the process command line, and the temporary file is automatically removed after execution.\n- [COMMAND_EXECUTION]: Shell script operations are hardened with input validation. The crawlora.sh script validates the API key format using character set restrictions and strictly enforces a GET-only policy for the workflow. It also rejects suspicious path sequences such as double dots or slashes to prevent directory traversal or URL manipulation.\n- [EXTERNAL_DOWNLOADS]: API calls are restricted to the vendor's primary domain (api.crawlora.net). The script uses a whitelist approach, validating every path against a predefined set of allowed routes using anchored regular expressions, which prevents the agent from being directed to unauthorized endpoints.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests SEC filing data which is external content. However, the risk is mitigated by the script's strict path and argument validation, and the instructions focus the agent on processing this data into structured financial summaries rather than executing it as instructions.

sec-insider-transaction-analysis