The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The scripts/run.py runner script retrieves the ALPHAGBM_API_KEY from environment variables to authenticate its requests to the AlphaGBM API. The skill's documentation in references/access.md provides guidance on secure secret management, advising users to avoid placing keys in chat history or code.
[DATA_EXFILTRATION]: The skill performs network operations to fetch market data and analysis from vendor-controlled domains (alphagbm.com, zeabur.app). The runner script enforces a specific host whitelist and disables HTTP redirects to ensure that API keys and request data are only transmitted to authorized endpoints.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from both external API responses (news, reports) and user-supplied local JSON files.
Ingestion points: Data enters the agent's context through scripts/run.py via API responses and file paths provided to the --transactions-file, --baseline, and --current arguments.
Boundary markers: The skill includes explicit instructions in references/access.md warning the agent to treat articles and API strings as untrusted data and to ignore any embedded instructions.
Capability inventory: The skill has the capability to perform network requests and read local files.
Sanitization: scripts/review_engine.py implements strict JSON parsing, prohibits non-finite numbers, and uses SHA-256 hashing to verify the integrity of data snapshots before they are processed.
[DYNAMIC_EXECUTION]: The script scripts/run.py uses importlib.util to dynamically load the local scripts/review_engine.py module. This is a functional requirement for the skill's snapshot comparison feature and is restricted to loading its own bundled scripts.
[COMMAND_EXECUTION]: The skill functions by executing a local Python script scripts/run.py, which acts as the main entry point for all research and scoring workflows.

alphagbm-options-score