The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill installs the @truenorth-ai/cli package from the public NPM registry during setup. This package is the primary interface for the skill's functionality.
[COMMAND_EXECUTION]: The skill's workflow requires executing a local binary named tn for all data retrieval tasks. The agent is instructed to run these commands in its local environment to interact with the TrueNorth API.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection or command injection because it instructs the agent to pass the raw user query directly into a shell command (tn ner "<user message>").
Ingestion points: Untrusted data enters the context via the <user message> and <user's full message> placeholders in SKILL.md and examples.md.
Boundary markers: The instructions use double quotes around the placeholder but do not specify shell escaping or sanitization requirements.
Capability inventory: The skill executes shell commands using the tn binary for entity recognition, technical analysis, and market data retrieval.
Sanitization: There are no explicit instructions for the agent to sanitize or validate the user input before it is interpolated into the shell command string.

truenorth