The Agent Skills Directory

[PERSISTENCE]: The README.md file provides instructions to register a SessionStart hook in .claude/settings.json. This configuration ensures that a specific command is executed automatically every time the agent initializes a new session.
[COMMAND_EXECUTION]: The skill triggers the execution of a local TypeScript file (.claude/hooks/load-fin-core-config.ts) using npx tsx. The contents of this script are not provided in the skill package, meaning it could perform any arbitrary local operations at startup.
[DATA_EXPOSURE]: A core function of the skill is to read sensitive files—such as .env, user-profile.yaml, and CSV files containing financial positions—and dump their contents into the LLM's prompt context. This exposes private financial data, including portfolio structures and income levels, to the model's active memory.
[PROMPT_INJECTION]: The SKILL.md file uses an override marker to mandate behavior: 'CRITICAL: Always execute date command before market research or analysis.' This is an instruction that attempts to force specific tool usage regardless of user intent.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data files that could serve as an attack vector for indirect injection.
Ingestion points: The skill reads config.yaml, user-profile.yaml, and multiple CSV files from the imports/ directory (e.g., Balances_for_Account_*.csv, Portfolio_Positions_*.csv).
Boundary markers: No boundary markers or 'ignore' instructions are used when outputting these file contents to the agent.
Capability inventory: The skill possesses significant capabilities via seven specialized CLI tools in the src/ directory (e.g., risk_metrics_cli.py, optimizer_cli.py, backtester_cli.py) which can be triggered based on ingested data.
Sanitization: There is no evidence of sanitization or validation for the CSV or YAML content before it is processed by the agent.

fin-core