The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script scripts/analyzer.py dynamically modifies the Python module search path (sys.path) at runtime to load dependencies from a sibling skill (market-price-tracker). This pattern involves dynamic loading from a computed path.
[DATA_EXFILTRATION]: Documentation in references/implementation.md directs the agent to read sensitive configuration data from config/crypto-apis.env. This constitutes a data exposure surface for local API credentials, although it aligns with common practices for secret management.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to the well-known CoinGecko API (api.coingecko.com) to fetch real-time cryptocurrency price and volume data using the requests library.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of untrusted data from external market APIs combined with its ability to execute local commands and write files.
Ingestion points: scripts/analyzer.py (CoinGecko API market data)
Boundary markers: Absent (untrusted data is processed directly into analysis objects)
Capability inventory: requests (network operations), Write (file system writes), Bash(python:*) (local script execution)
Sanitization: Absent (the skill performs calculations on external data but does not explicitly sanitize it against instruction-like content)
[COMMAND_EXECUTION]: The skill is configured to execute local Python scripts via the Bash tool as part of its primary scanning and analysis workflow.

scanning-market-movers