The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a wrapper script scripts/run.py that executes multiple shell commands via subprocess.run to manage virtual environments, install packages, and launch the core trends script.
[EXTERNAL_DOWNLOADS]: The scripts/run.py script performs runtime installation of Python packages (trendspyg[analysis], selenium, requests) using pip. This bypasses static environment configuration and introduces potential supply chain risks from non-standard libraries.
[INDIRECT_PROMPT_INJECTION]: The skill processes external search trend data that could potentially contain malicious instructions intended to influence the agent's output formatting or behavior.
Ingestion points: Data is ingested through RSS feeds and CSV downloads from Google Trends in scripts/trends.py.
Boundary markers: No boundary markers or 'ignore' instructions are used when processing the trend data.
Capability inventory: The skill possesses network access, file writing capabilities (temporary CSVs), and command execution via the wrapper script.
Sanitization: No sanitization is performed on the trend strings retrieved from external sources before they are passed to the agent for display.
[METADATA_POISONING]: The skill includes a file named .security-scan-passed which contains claims about passing security validations. This is an attempt to influence the evaluator's trust through self-asserted safety claims.

google-trends