The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads sensitive financial information, including portfolio positions, quantities, and unrealized profit/loss, from an absolute file path: /Users/engineer/workspace/backtest/.cache/stocks-daily/positions.csv. While intended for its core purpose, this pattern accesses data outside the immediate skill directory.
[DATA_EXFILTRATION]: The skill accesses Telegram configuration, including channel IDs and potentially sensitive invite links, from /Users/engineer/workspace/backtest/.cache/stocks-daily/telegram.yaml at runtime.
[COMMAND_EXECUTION]: Shell commands (grep, sed) are used to extract values from local configuration files, and the skill executes a Python script (~/.agents/skills/telegram-cli/telegram-cli.py) to send data to an external Telegram channel.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from user-maintained CSV files and project memory logs. This data is interpolated into prompts for the stocks-advisor skill and the Telegram report without explicit boundary markers or sanitization, potentially allowing malicious content in the data files to influence agent behavior.
Ingestion points: Reads positions.csv and .agents/memory/YYYY-MM-DD.md.
Boundary markers: None present; data is parsed and passed directly into analysis and report strings.
Capability inventory: Ability to execute shell commands via python3 and transmit data to Telegram.
Sanitization: No evidence of escaping or filtering logic for the ingested stock data before it is formatted into messages.

stocks-daily