The Agent Skills Directory

[DATA_EXFILTRATION]: The skill performs a registration process that transmits sensitive information to an external server. The POST {WATCHER_BASE_URL}/v1/register request includes the sender_key (obtained via a secure secret-request card) and the user's routine webhook_url. While this is core to the skill's registration functionality, it involves sending credentials to a dynamic endpoint defined in the agent's memory.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from an external webhook source, which presents an indirect injection surface.
Ingestion points: Webhook payloads described in references/feed-setup.md containing ticker, headline, and url fields.
Boundary markers: None explicitly defined in the instructions for processing the webhook data.
Capability inventory: Network POST/PATCH/DELETE operations to WATCHER_BASE_URL and modification of the agent's internal memory (watchlist).
Sanitization: No specific sanitization or validation of the headline or url fields from the webhook payload is mentioned before they are processed or displayed.

ticker-wire