Xerolite

This skill appears to do what it says: it posts order and contract-search JSON to a Xerolite API (defaulting to http://localhost). Before installing: - Confirm where XEROLITE_API_URL will point. If you set it to a remote host, that host will receive order payloads — only configure it to trusted infrastructure. - Understand the risk: the skill can place orders. If your agent is allowed to call skills autonomously, consider requiring manual confirmation or restricting agent permissions to avoid unintended trades. - Note the minor metadata mismatch: SKILL.md documents an optional XEROLITE_API_URL env var but the manifest did not list required/optional env vars. That discrepancy is low-risk but worth noticing. - The current version does not use authentication. Do not expose a Xerolite instance without network protections or API keys; prefer running Xerolite on a local or isolated network if you plan to allow automatic order placement. If you want higher assurance, request the publisher add explicit manifest entries for the optional env var, and add an authentication mechanism (API key) or a configuration option that requires explicit confirmation before placing live orders.