The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a Python script (scripts/fetch_weekly_data.py) to interact with the longbridge CLI tool. It retrieves market data, portfolio information, and order history. The script correctly uses subprocess.run with an argument list rather than a raw shell string, which is a security best practice to prevent shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The HTML report template (assets/report_template.html) references the Lightweight Charts library hosted on unpkg.com. This is a standard and well-known content delivery network (CDN) used for including open-source financial visualization libraries.
[DATA_EXPOSURE]: The skill accesses sensitive financial information, including portfolio holdings and trade history, through the brokerage CLI. This access is consistent with the skill's primary stated purpose of generating investment reports and the data remains within the user's local environment (.invest-data directory).
[INDIRECT_PROMPT_INJECTION]: The skill processes external data such as financial news and market metrics which are eventually included in a generated report. While this presents a surface for indirect injection (e.g., malicious content in a news headline), the risk is low as the data is used for structured reporting and technical analysis rather than driving autonomous agent actions.
Ingestion points: Data enters the system through longbridge news, longbridge kline, and longbridge portfolio commands in scripts/fetch_weekly_data.py.
Boundary markers: The skill does not explicitly define delimiters for external content in its instructions.
Capability inventory: The skill performs local file writes, runs local CLI commands, and generates HTML/Markdown files.
Sanitization: The Python script fetches raw JSON data; sanitization is expected to be handled by the agent during the report interpolation phase.

longbridge-invest-analysis-us