The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches cryptocurrency market data from the Binance API (api.binance.com). This is a well-known service, and the data is utilized for trading signal calculations. The network operations do not target untrusted, risky, or suspicious domains.
[COMMAND_EXECUTION]: The skill contains instructions to execute a shell script (scripts/scan_signals.sh) and a multi-line Bash/Python snippet for calculating market support and resistance levels. These commands are standard for processing external data locally and do not involve privilege escalation, suspicious environment modification, or persistence mechanisms.
[UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: An automated scan flagged a command piping Binance API data to Python as potential remote code execution. However, the command in SKILL.md uses the -c flag to execute specific local code provided in the markdown body. This utilizes the piped data as input rather than executing the remote content itself. As the source (Binance) is a well-known service and the execution logic is hardcoded locally, this does not constitute a malicious RCE pattern.
[DATA_EXPOSURE_AND_EXFILTRATION]: No sensitive local files, such as credentials, SSH keys, or environment variables, are accessed or transmitted. Network operations are strictly limited to fetching public market data from the Binance API.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes data from an external API.
Ingestion points: scripts/scan_signals.sh (fetching Binance JSON) and SKILL.md (S6 calculation snippet).
Boundary markers: Absent; the data is directly passed to processing tools like jq and python3.
Capability inventory: Network operations (curl), shell script execution (bash), and file-write capabilities for logging simulated trades to data/paper-trading/.
Sanitization: The skill uses jq to parse the JSON data into specific numerical fields, which provides validation and prevents the raw API response from being interpreted as instructions by the agent.
[DYNAMIC_EXECUTION]: The skill utilizes python3 -c to execute a local script string that processes market data. This is a low-risk pattern used here for calculation rather than runtime code generation from untrusted sources.

btc-5min-scalper