The Agent Skills Directory

[SAFE]: The skill implements a robust 'no-fabrication guardrail', requiring all macro-economic data points (CPI, FOMC, GDP) to be retrieved via live, dated fetches from official sources like the BLS, Fed, and BEA. It explicitly forbids using remembered or hallucinated figures.
[SAFE]: The McKinsey persona is clearly identified as a stylistic choice rather than a claim of official affiliation, mitigating risks of deceptive metadata or impersonation.
[DATA_EXPOSURE]: The skill processes user-provided financial holdings and weights to perform risk analysis. While this is sensitive data, the processing is handled through designated internal skills (e.g., risk-desk) for deterministic risk assessment, and no unauthorized exfiltration patterns were observed.
[INDIRECT_PROMPT_INJECTION]: The skill accepts portfolio data via manual input or external URLs (e.g., spreadsheets), which serves as a potential attack surface for indirect prompt injection.
Ingestion points: User-provided holdings list or spreadsheet URL specified in the inputs section.
Boundary markers: The instructions do not define specific delimiters to isolate untrusted data from the agent's internal logic.
Capability inventory: The skill uses web_fetch for data retrieval and can invoke multiple other skills (feed-cpi, feed-fomc, macro-panel, analyse-macro, risk-desk) to perform complex analysis and reporting.
Sanitization: There is no explicit logic described for sanitizing or validating the structure of the ingested data beyond the requirement for live fetches.

hedgefund-mckinsey-macro