The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/setup.sh and scripts/update.sh scripts clone and execute source code from an external, third-party GitHub repository (github.com/ZhuLinsen/daily_stock_analysis) that is not listed as a trusted vendor. This allows for arbitrary code execution from an unverified source.
[COMMAND_EXECUTION]: scripts/market_data_bridge.py utilizes subprocess.run to execute Python scripts. The execution path is dynamically constructed using a configurable variable (market_data_skill_path) from the config.json file, allowing the execution of local files through the agent.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection within scripts/ai_analyzer.py.
Ingestion points: Financial data including stock names and technical indicators are fetched via akshare and interpolated into the _build_prompt method.
Boundary markers: None; the data is directly embedded into the natural language prompt.
Capability inventory: The skill has the capability to execute subprocesses (via market_data_bridge.py) and perform network operations.
Sanitization: There is no evidence of sanitization or escaping of the stock data before it is sent to the LLM.
[EXTERNAL_DOWNLOADS]: The skill performs external downloads during setup, fetching Python packages from PyPI and source code from external Git repositories via pip and git commands.

stock-daily-analysis