The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill's documentation contains hardcoded strings formatted as Trading 212 API keys and secrets. While labeled as 'sample credentials', these strings do not use standard placeholder formats (such as '<YOUR_API_KEY>') and could potentially be active or previously active credentials. Evidence in SKILL.md: '35839398ZFVKUxpHzPiVsxKdOtZdaDJSrvyPF' and '7MOzYJlVJgxoPjdZJCEH3fO9ee7A0NzLylFFD4-3tlo'.\n- [COMMAND_EXECUTION]: The skill heavily relies on the agent executing shell commands (curl, jq, bc) to interact with financial APIs, place market/limit orders, and manage sensitive account information. This provides a direct path for the agent to perform high-impact financial transactions.\n- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes data from external Trading 212 API endpoints (e.g., instrument names, order history) without boundary markers or sanitization instructions for the agent. Ingestion points: 'metadata/instruments', 'account/summary', and 'history/orders'. Boundary markers: Absent. Capability inventory: Shell execution for financial trading and file system writes. Sanitization: Absent for API response data.

trading212-api