The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data via the ${var} variable to determine whether to execute a financial trade. While it implements parsing logic and sanity checks, this pattern exposes a vulnerability surface where maliciously crafted input could attempt to manipulate trading behavior.
Ingestion points: ${var} in SKILL.md.
Boundary markers: The instructions require specific prefixes (trade:) and parameters (side, symbol, size) to proceed.
Capability inventory: File writes (via ./notify), network operations (via agent.robinhood.com/mcp/trading), and execution of local shell scripts.
Sanitization: Implements checks against account buying power and position sizes before execution.
[COMMAND_EXECUTION]: The skill executes local shell scripts and tools to maintain its workflow.
Execution path: Calls scripts/mcp-oauth-refresh.sh to handle token rotation and ./notify to deliver reports.
Environment: Accesses environment variables including MCP_ROBINHOOD_TRADING_TOKEN and GH_SECRETS_PAT.
[DATA_EXFILTRATION]: The skill reads highly sensitive financial information (portfolio value, positions, order history) and transmits summaries via a notification tool.
Network operations: Communicates with agent.robinhood.com which is a well-known service associated with the intended functionality.
Sensitive data: Accesses brokerage account details and OAuth credentials.

robinhood-mcp