The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instructions in SKILL.md direct the user to clone a repository from https://github.com/stxkxs/mkt and build a binary (mkt). This binary is subsequently executed by the check.ts script using Bun.spawn to perform core data fetching and indicator calculation tasks. This pattern constitutes execution of code from an unverifiable remote source.\n- [EXTERNAL_DOWNLOADS]: The skill requires downloading external source code from a non-whitelisted and unknown GitHub user (stxkxs) to function, presenting a supply chain risk.\n- [COMMAND_EXECUTION]: The check.ts and mkt-alert.ts scripts execute external commands via Bun.spawn, including the compiled mkt binary and a Python script located at ~/.agents/skills/telegram-cli/telegram-cli.py.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests market data from external sources which could be manipulated to influence agent behavior or triggered alerts.\n
Ingestion points: Market price and OHLCV history data fetched via mkt mcp in check.ts.\n
Boundary markers: None present in the data ingestion flow.\n
Capability inventory: Subprocess execution via Bun.spawn and network requests via fetch.\n
Sanitization: Limited to regex extraction and floating-point parsing of price strings.

mkt