The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent and the user to download the primary application code from an external GitHub repository (jackson-video-resources/claude-tradingview-mcp-trading) that is not identified as a trusted source.
[COMMAND_EXECUTION]: The skill provides instructions to execute several shell commands, including cloning external repositories, installing Node.js dependencies (npm install), and running execution scripts (node bot.js). It also includes a node -e command for executing dynamic JavaScript strings to test API connectivity.
[CREDENTIALS_UNSAFE]: The skill manages highly sensitive financial credentials, specifically BitGet API keys, secrets, and passphrases. It guides the user to store these in a .env file, which is a common but high-risk practice for automated trading systems.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its strategy extraction workflow.
Ingestion points: The prompts/01-extract-strategy.md file processes untrusted YouTube transcript data from an external scraper (Apify).
Boundary markers: There are no boundary markers or instructions to ignore embedded commands within the ingested transcript content.
Capability inventory: The skill possesses significant capabilities, including file system writes (fs.appendFileSync), network access for trade execution via the ccxt library, and subprocess execution.
Sanitization: No sanitization or validation of the transcript content is performed before it is processed by the agent to generate the rules.json file.

claude-tradingview-mcp-autotrading