The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill connects to the vendor's official domains, data.diemeng.chat and mg.diemeng.chat, to retrieve financial market data. These network operations are the primary and stated purpose of the skill and are performed using the standard Python requests library.
[INDIRECT_PROMPT_INJECTION]: The skill processes structured financial data from an external API. While this theoretically exposes the agent to indirect prompt injection if the API content were malicious, the risk is negligible due to the data's structured JSON format and technical nature.
Ingestion points: API responses fetched in stock_api.py and returned to the agent's context via tool outputs.
Boundary markers: The instructions in SKILL.md provide explicit guidance on how the agent should interpret and call the specific data functions.
Capability inventory: The skill possesses network access to the vendor's API but lacks capabilities for file-system modification or arbitrary command execution.
Sanitization: The skill uses standard JSON parsing (response.json()) and type-hinted functions to handle API data.
[SAFE]: The skill follows secure secret management protocols by directing users to use the STOCK_API_KEY environment variable or a config.json template, ensuring that sensitive API keys are not hardcoded or leaked in the source code.

openclaw-stock-skill