The Agent Skills Directory

[OBFUSCATION]: The main engine script 5minbtc-engine-v6.0.py globally disables SSL certificate verification using ssl._create_default_https_context = ssl._create_unverified_context. While documented as a workaround for network latency, this is a significant security bypass that exposes all HTTPS traffic from the engine to Man-in-the-Middle (MitM) attacks.
[EXTERNAL_DOWNLOADS]:
The skill fetches financial data from several well-known services, including Binance, Coinbase, and Alternative.me. These are legitimate data sources for the skill's primary purpose.
The script scripts/fetch-github-repo.sh is designed to download and extract source code from GitHub repositories. While GitHub is a trusted service, the execution and extraction of external code is a sensitive operation.
[COMMAND_EXECUTION]: Multiple scripts, including scripts/5minbtc-monitor.py and scripts/5minbtc_watch.py, use subprocess.run to orchestrate the execution of internal components (e.g., calling the engine or logging scripts). This pattern is used for coordination between the skill's various Python components.
[DYNAMIC_EXECUTION]: Scripts such as scripts/5minbtc_realtime.py and scripts/5minbtc_watch.py use importlib.import_module to dynamically load the 5minbtc_trader module. This is used for internal modularity within the skill.
[INDIRECT_PROMPT_INJECTION]: The skill represents a vulnerability surface for indirect prompt injection as it ingests untrusted data:
Ingestion points: 5minbtc-news.py fetches headlines from the CoinDesk RSS feed.
Boundary markers: Absent. Headlines are passed into the agent's context for analysis without explicit delimiters or warnings to ignore embedded instructions.
Capability inventory: The skill has significant capabilities, including executing shell commands via subprocess and interacting with the Binance API using sensitive credentials stored in environment variables.
Sanitization: The classify function in 5minbtc-news.py uses keyword matching but does not filter or sanitize the headline text for potential instructions.

5minbtc