The Agent Skills Directory

[COMMAND_EXECUTION]: The skill operates by executing local Node.js scripts (qcc_client.js and qcc_bidding_fmt.js) to interact with the Qichacha API and process data.
[EXTERNAL_DOWNLOADS]: Communicates with agent.qcc.com to retrieve business intelligence data, which is an established domain for the Qichacha platform.
[PROMPT_INJECTION]: Instructs the agent to assist the user in setting up their environment by writing the provided API key to a .env file, adhering to standard configuration patterns.
[DATA_EXPOSURE]: Implements secure credential handling by reading the QCC_API_KEY from environment variables or a local .env file rather than hardcoding it in the scripts.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface as it ingests untrusted data from an external API (e.g., news sentiment, announcements).
Ingestion points: scripts/qcc_client.js and scripts/qcc_bidding_fmt.js ingest JSON data from agent.qcc.com.
Boundary markers: No explicit delimiters are used to separate API data from the agent's instructions.
Capability inventory: The skill can execute local shell commands to run its internal Node.js scripts.
Sanitization: No explicit sanitization of API response content is performed before outputting to the console.

qcc-bidding