The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses uvx, uv run, and curl to execute shell commands for web searching and data fetching. It specifically instructs the agent to run the web-forager CLI and a custom Python script using the ddgs library to retrieve market data.
[EXTERNAL_DOWNLOADS]: At runtime, the skill fetches the web-forager package and the ddgs library from the public Python Package Index (PyPI) using the uv tool. This introduces a dependency on external, third-party code that is not version-pinned for all components.
[PROMPT_INJECTION]: The skill is designed to ingest and process content from arbitrary web URLs and search results, creating an attack surface for indirect prompt injection.
Ingestion points: Web content fetched via the Jina Reader service and search result snippets from DuckDuckGo.
Boundary markers: None identified; there are no explicit instructions for the agent to treat external content as untrusted or to ignore embedded instructions within the fetched markdown.
Capability inventory: The agent has subprocess execution capabilities (uvx, uv run, curl) which could potentially be abused if fetched content successfully influences agent behavior.
Sanitization: No validation or sanitization of the fetched web content is performed before the data is processed by the agent.

competitive-intel