The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse untrusted user-uploaded .htm reports from the MT5 Strategy Tester.
Ingestion points: Data enters the system through the POST /api/tests/import-report endpoint as described in SKILL.md.
Boundary markers: The instructions do not define specific delimiters to isolate the parsed report data from the agent's core instructions.
Capability inventory: The skill performs file system writes to {data-dir}/reports/ and {data-dir}/equity-history/, and includes logic for broker connectivity checks.
Sanitization: The skill's documentation explicitly warns against skipping sandboxing and recommends script stripping on ingest, showing awareness of this threat vector.
[COMMAND_EXECUTION]: The broker resolution logic incorporates a ping operation to verify connectivity. While the skill suggests matching server names against internal configurations, there is a risk of command injection if unsanitized server identifiers from the HTML reports are passed to shell-based connectivity tools.
[EXTERNAL_DOWNLOADS]: The skill retrieves price and equity data from Darwinex, a well-known financial services provider, to facilitate equity curve reconstruction when local broker data is missing. This is a standard and expected functionality for the skill's purpose.

imported-backtest