The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting data from external files, specifically Fidelity CSV exports.
Ingestion points: Processes ~/Downloads/Portfolio_Positions_*.csv, Balances_for_Account_*.csv, and History_for_Account_*.csv to extract position and balance data.
Boundary markers: The skill relies on structured CSV column parsing and header validation (e.g., checking for 'Ex-date' or 'Average Cost Basis') but does not employ explicit prompt-level delimiters for the ingested data.
Capability inventory: Includes file system operations (mv, rm, head, fd, ls), subprocess execution via the uv tool, and external API interaction through mcp__gdrive__sheets for Google Sheets updates.
Sanitization: Implements 'Safety Gates' requiring user confirmation for significant changes, such as quantity variations > 10%, cost basis changes > 20%, or SPAXX cash discrepancies > $100.
[DATA_EXFILTRATION]: The skill accesses sensitive information, including local brokerage CSVs, configuration files (user-profile.yaml, snaptrade-accounts.yaml), and environment variables containing API keys (SNAPTRADE_CLIENT_ID, etc.) in order to sync them with a Google Sheets spreadsheet. This behavior is consistent with the skill's primary purpose of financial tracking.
[COMMAND_EXECUTION]: The workflows utilize several shell commands to manage local files and execute the SnapTrade integration.
File Management: Uses fd, mv, rm, head, and ls for locating, moving, and verifying brokerage files in the user's Downloads directory.
Subprocess Invocation: Executes the SnapTrade integration script via uv run python -m src.integrations.snaptrade.cli to fetch live positions and balances.

portfolio-syncing