Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed earnings-research helper that sends user-requested finance queries and a Crawlora API key to Crawlora, with no evidence of hidden persistence, privilege escalation, destructive actions, or unrelated data access.
Install only if you are comfortable sending ticker/company queries, dates, and your Crawlora API key to Crawlora. Use a dedicated Crawlora key, keep it out of logs and committed files, and review outputs as research evidence rather than trading advice.
Set `CRAWLORA_API_KEY` to your key from [crawlora.net](https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills). Run the bundled `scripts/crawlora.sh` from this skill directory or by absolute path. It sends `x-api-key` to `https://api.crawlora.net/api/v1`; keep the key in the environment. Read [reference/endpoints.md](reference/endpoints.md) for the selected Yahoo Finance and SEC tools and their exact parameters.
#!/usr/bin/env bash # Crawlora REST helper — minimal, dependency-free (curl only). # Calls https://api.crawlora.net/api/v1 with your Crawlora API key. # Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills. #
#!/usr/bin/env bash # Crawlora REST helper — minimal, dependency-free (curl only). # Calls https://api.crawlora.net/api/v1 with your Crawlora API key. # Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills. # # Usage:
#!/usr/bin/env bash # Crawlora REST helper — minimal, dependency-free (curl only). # Calls https://api.crawlora.net/api/v1 with your Crawlora API key. # Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills. # # Usage:
#!/usr/bin/env bash # Crawlora REST helper — minimal, dependency-free (curl only). # Calls https://api.crawlora.net/api/v1 with your Crawlora API key. # Get a free key (2,000 credits/mo, no card) at https://crawlora.net?utm_source=github&utm_medium=referral&utm_campaign=crawlora-skills. # # Usage:
# Keep the API key out of the curl process command line. A private temporary
# config supplies the header and is removed automatically on exit.
curl_config="$(mktemp "${TMPDIR:-/tmp}/crawlora-curl.XXXXXX")"
chmod 600 "$curl_config"
trap 'rm -f "$curl_config"' EXIT
printf 'header = "x-api-key: %s"\n' "$CRAWLORA_API_KEY" >"$curl_config"
auth=(--config "$curl_config")[ -n "$body" ] || body='{}'
# Stream the body on stdin so curl never interprets a user value as its
# @file shorthand (and cannot read local files supplied in a request body).
printf '%s' "$body" | curl -fsS -X "$method" "${auth[@]}" \
-H "Content-Type: application/json" --data-binary @- "${base}${path}"
fiNo suspicious patterns detected.