The Agent Skills Directory

[COMMAND_EXECUTION]: The skill requires the execution of shell commands to activate virtual environments and run Python scripts for data processing. Evidence found in references/data-queries.md with commands such as source ../../.venv/bin/activate and python ../findata-toolkit-cn/scripts/views_runner.py.
[EXTERNAL_DOWNLOADS]: The skill installs dependencies from a local relative path using pip. Evidence found in references/data-queries.md: python -m pip install -r ../findata-toolkit-cn/requirements.txt.
[DATA_EXFILTRATION]: The skill fetches data from external financial services including Sina, EastMoney, and Snowball. It uses environment variables like XUEQIU_TOKEN for authenticated data access. This is standard functionality for a financial tool but involves external network requests.
[REMOTE_CODE_EXECUTION]: The skill executes Python scripts from a directory outside its own package (../findata-toolkit-cn/). This dependency on external local code is part of the vendor's modular design but constitutes execution of non-skill code.
[PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection. ● Ingestion points: Fetches financial reports, industry data, and market metrics from AKShare and Sina (references/methodology.md). ● Boundary markers: None identified; the skill processes ingested data directly into its analytical framework. ● Capability inventory: The agent can execute shell commands and write to /tmp/finskills-cache (references/data-queries.md). ● Sanitization: No explicit data sanitization or instruction-filtering is mentioned for the ingested external content.

peer-comparison-analyzer