The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes a bundled Python script (scripts/run.py) to perform API interactions and data processing. The execution is scoped to specific commands (report, research, news, etc.) and uses validated arguments derived from user research queries.
[EXTERNAL_DOWNLOADS]: The runner script fetches research report data and metadata from official AlphaGBM domains. It implements a strict hostname whitelist (HOSTS) and disables HTTP redirects to prevent server-side request forgery (SSRF).
[INDIRECT_PROMPT_INJECTION]: As the skill processes prose from research reports and news commentary, it is exposed to potential indirect prompt injection. However, the skill provides clear boundary markers and instructions to the agent to read the returned JSON as evidence only and to ignore any instructions embedded in retrieved articles or reports.
[DYNAMIC_EXECUTION]: The run.py script uses importlib.util to dynamically load the bundled review_engine.py module. The path to this module is statically resolved relative to the script's location and is not influenced by user input.
[SAFE]: The skill demonstrates multiple security best practices, including environment-variable-based credential management, size limits on network responses, anti-injection JSON parsing constants, and mandatory user confirmation for potentially charged API actions.

alphagbm-report-breakdown