The Agent Skills Directory

[DATA_EXFILTRATION]: The skill incorporates a local credential resolution mechanism that accesses files outside its directory to authenticate with the vendor API.
Evidence: The _resolve_aisa_api_key function in scripts/market_client.py traverses paths such as ~/.aisa/credentials, $HERMES_HOME/.env, and specific profile directories to locate the AISA_API_KEY value.
Context: This behavior is intended for secret management within the supported harnesses and transmits the key only to the verified vendor API domain api.aisa.one.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external financial data which represents a surface for indirect prompt injection.
Ingestion points: company_news, earnings_press_releases, and sec_filings endpoints in scripts/market_client.py retrieve text from external sources.
Boundary markers: The skill does not implement explicit delimiters or instructional guardrails for the agent when processing this fetched content.
Capability inventory: The skill uses urllib.request to perform network operations to the vendor's domain.
Sanitization: Fetched content is returned as raw data without sanitization or escaping.

marketpulse