The Agent Skills Directory

EXTERNAL_DOWNLOADS (LOW): The skill requires the installation of the octagon-mcp package via npx. While this is the core functionality of the skill, the package is hosted by an organization (OctagonAI) not currently in the trusted repository list. The severity is lowered as this is the intended primary purpose of the skill.
Evidence: README.md and references/mcp-setup.md instruct the user to run npx -y octagon-mcp.
PROMPT_INJECTION (LOW): The skill exhibits a surface for indirect prompt injection (Category 8) where user-controlled input is passed to an underlying agent tool.
Ingestion points: User-provided values for <TICKER>, <N>, and <FY|Q> in SKILL.md.
Boundary markers: Absent. The values are interpolated directly into a natural language prompt string for the tool.
Capability inventory: The octagon-agent tool is called, which processes the generated prompt.
Sanitization: No sanitization or validation of the ticker format or period parameters is performed within the skill logic.
CREDENTIALS_UNSAFE (SAFE): The skill correctly identifies the need for an API key but uses placeholders and environment variables rather than hardcoding sensitive information.
Evidence: references/mcp-setup.md uses <your-api-key> and YOUR_API_KEY_HERE.

cash-flow-growth