The Agent Skills Directory

[PERSISTENCE]: The skill instructions and README recommend modifying shell configuration files to store sensitive API tokens as environment variables.
Evidence in README.md: echo 'export TUSHARE_TOKEN="your_token_here"' >> ~/.bashrc.
Evidence in SKILL.md: export TUSHARE_TOKEN="your_token".
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted third-party data from financial news and announcements and possesses the capability to execute code.
Ingestion points: The skill fetches news content, company announcements, and interactive investor Q&A text from the Tushare API (e.g., in files like reference/接口文档/新闻快讯(短讯).md and reference/接口文档/上证e互动问答.md).
Boundary markers: The instructions lack boundary markers or specific warnings to the agent to ignore instructions embedded within the retrieved financial data.
Capability inventory: The skill is granted Bash(python:*) permissions in SKILL.md, allowing the execution of arbitrary Python code.
Sanitization: No evidence of data sanitization or filtering is present to prevent adversarial content in news or announcements from influencing agent behavior.
[METADATA_POISONING]: There is a mismatch between the author metadata within the skill files and the author information provided in the analysis context.
Evidence: Skill files (README.md, metadata.json) identify the author as 'StanleyChanH', whereas the provided author context for this analysis is 'bobibobuyu'.

tushare-finance