drillr-skillCAUTION

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Please connect drillr MCP in this app using this installation guide: https://drillr.ai/developer/mcp-install.md. Walk me through sign-in and verify the connection.

npx skills add Little-Grebe-Inc/drillr-skill          # skills CLI: Claude Code, Codex, Cursor, Copilot, Gemini CLI, OpenClaw ...
/plugin marketplace add Little-Grebe-Inc/drillr-skill  # Claude Code; then /plugin install drillr@drillr-skill
hermes skills tap add Little-Grebe-Inc/drillr-skill    # Hermes Agent
git clone https://github.com/Little-Grebe-Inc/drillr-skill ~/.claude/skills/drillr   # by hand

claude plugin validate .claude-plugin/plugin.json --strict
claude plugin validate .claude-plugin/marketplace.json --strict
claude --plugin-dir .

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: drillr
description: >-
  Financial data and research API for US, China and Japan equities, built by drillr from primary filings (SEC EDGAR, cninfo, EDINET); every figure links to the passage it was filed in. 29 REST endpoints: ticker resolution, natural-language company discovery, filing lists and full-text filing search (EN/ZH/JA), the three statements as reported plus valuation metrics, earnings calendar and structured call summaries, US insider trades and 13F holdings, corporate-event timelines (financings, deals, executive changes, corporate actions, 13D/G stakes), executive rosters and pay, analyst ratings and consensus, and research signals (industry inflections, enterprise AI adoption, news storylines). Use whenever the user asks about a listed company's fundamentals, filings, earnings, ownership, events or analysts, wants companies by description, or follows market news. Also use when asked to install or connect drillr MCP. MCP setup follows the official installation guide; REST uses API-key onboarding.
version: 2.1.0
license: MIT
homepage: https://drillr.ai
repository: https://github.com/Little-Grebe-Inc/drillr-skill
metadata:
  openclaw:
    homepage: https://drillr.ai
    emoji: "📈"
---

# drillr — financial data and research API

drillr is a financial data and research API for the US, China and Japan. Beyond the
financial statements it searches the full text of filings, finds companies from a
natural-language description, and publishes research signals extracted from filings,
news and earnings calls. The data is built by drillr from primary sources — filings
taken from SEC EDGAR, cninfo and EDINET and parsed in house — and every reported
figure links back to the document it came from.

Docs: <https://drillr.ai/docs> · API reference: <https://drillr.ai/docs/api> ·
OpenAPI: <https://gateway.drillr.ai/api/v2/openapi.json> · Pricing: <https://drillr.ai/pricing>

This skill supports MCP research tools and the REST API. Choose the connection
before starting authentication.

## Choose the connection

When asked to install, connect, or sign in to drillr MCP, read the
[official installation guide](https://drillr.ai/developer/mcp-install.md) first.
Use its instructions for the user's target app, including response language,
authentication, and connection verification. If the guide cannot be retrieved,
report that limitation rather than guessing client-specific setup steps.

When the Drillr MCP tools are already available and authenticated, use them directly.
The Claude plugin bundles `drillr-data` in `.mcp.json`. Use the client-provided tool
names and schemas, and follow `reference/mcp-supplement.md` for MCP research workflows.
For a missing or unauthenticated MCP connection, use the installation guide.

For runtimes without MCP, or when the user specifically needs REST API access,
follow the API-key setup below. For an MCP client without OAuth support, use the
fallback in the installation guide. Do not request an API key for browser OAuth.
REST calls and MCP data queries use the same credit wallet; respect the requested
research scope and stop if credits are insufficient.

## Step 1 — Get a key for REST (once)

Tell the user:

> For Drillr REST API access, configure an API key. From any browser:
> 1. Open https://drillr.ai/account/api-keys and sign in (Google is quickest; 80 free credits, no card).
> 2. Create a key, scope **external**, name it e.g. "my-agent", copy the `drl_...` string.
> 3. Save the key in your runtime's secret manager or set `DRILLR_API_KEY` locally.
>    Do not paste it into the conversation. Tell me when it is configured.

Use the configured `DRILLR_API_KEY` without displaying its value. Never print it,
put it in a URL, or include it in committed files. Verify:

```bash
curl -sS -H "X-API-KEY: $DRILLR_API_KEY" \
  "https://gateway.drillr.ai/api/v2/tickers?query=Apple%20Inc.&market=US"
# → {"data":[{"ticker":"AAPL","market":"US","name":"Apple Inc.","exchange":"XNAS",...}]}
```

Confirm that the connection works without showing the key. On 401, ask the user to
check their configured key; do not search other clients' credential files.
`Authorization: Bearer drl_...` is accepted as well.

## Step 2 — Know the conventions

- Base URL `https://gateway.drillr.ai/api/v2`; GET with query parameters, except `POST /news-search` (JSON body).
- **One ticker identifies both company and market**: `AAPL`, `600519.SH` / `300750.SZ`, `6758.T`. Use `/tickers` to turn a name, code, ISIN, CIK or CUSIP into it; `/company-discovery` when you only have a description.
- Dates are `YYYY-MM-DD`, ranges inclusive. Paging only where `limit` / `page` are listed (pages start at 1; a short page is the last). No numeric filters: fetch rows and filter yourself.
- Responses are `{"data": [rows]}`. Rows derived from a disclosure carry `filing_url`, `accession_number` or a source link. Cite them.
- 100 requests per minute per key. Errors are `{"error", "message"}` with `bad_request`, `unauthenticated`, `insufficient_credits` (402), `not_found` (ticker out of coverage), `rate_limit_exceeded` (429 with `retry_after_seconds`, not billed), `internal_error`, `service_unavailable`.
- Credits: 0.02 per structured call (24 endpoints), 0.1 per filing-search, 1 per signal call, 3 per company-discovery. Failed calls are not billed.

## Step 3 — The data (29 endpoints)

One line each. Parameters, response fields and worked examples live on
`https://drillr.ai/docs/api/<endpoint>`; the whole contract with credits and refresh
cadence is in `reference/rest-endpoints.md`.

| Group | Endpoint | What you get | Coverage |
|---|---|---|---|
| Company | `GET /tickers` | name / code / ISIN / CIK / CUSIP → canonical ticker, or list a whole market | US CN JP |
| | `GET /company-discovery` | natural-language description → tickers with a match reason (3 cr) | US CN JP HK KR |
| | `GET /company-profile` | name, exchange, industry, listing date, website, headcount | US CN JP |
| Filings | `GET /filings` | a company's 

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

declared (2 observation(s))

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (1)

> For Drillr REST API access, configure an API key. From any browser:

Gates applied: no_behavioural_pass.