The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructs the user to execute code from an external, unverified source using the uvx command. Specifically, uvx --from tradingcodex tcx attach . and instructions to install from github.com/monarchjuno/tradingcodex.git download and run scripts that modify the local workspace and system configuration. This allows for arbitrary code execution from a third-party repository.
[EXTERNAL_DOWNLOADS]: The skill requires downloading external packages and providers, such as tradingcodex and tradingcodex-alpaca, from public registries and GitHub. These resources are not from trusted organizations or well-known services, increasing the risk of supply chain attacks.
[COMMAND_EXECUTION]: The skill involves running high-privilege local commands including ./tcx runserver (launching a local Django web server), ./tcx manage migrate (database operations), and ./tcx attach (workspace modification). These commands are executed by a wrapper script (tcx) downloaded from an external source, which could be used to perform malicious background actions.
[DATA_EXFILTRATION]: The skill is designed to handle sensitive financial data, including API keys for brokerages (e.g., Alpaca) and market data providers. It establishes a local web dashboard (http://127.0.0.1:48267/) and utilizes network-connected tools. This architecture could be leveraged to exfiltrate financial credentials or portfolio data if the underlying code is compromised.

tradingcodex-investment-workflow