The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill implements a self-modifying code pattern. In the 'Neo4j Subagents' section, it instructs the agent to immediately execute skill updates using the 'Edit' tool if a response contains a 'SKILL_UPDATE_NEEDED' block, explicitly stating this should be done with 'no permission needed'. This bypasses human review and allows the agent's behavior to be altered at runtime.
[COMMAND_EXECUTION]: Step 11 of the workflow ('Build Thinking Index') requires the execution of a Python script via the 'Bash' tool using a shell command: python3 $CLAUDE_PROJECT_DIR/.claude/skills/earnings-orchestrator/scripts/build-thinking-index.py {accession_no}. While the script path is internal to the project, autonomous shell execution of scripts is a security risk.
[PROMPT_INJECTION]: The skill is highly vulnerable to indirect prompt injection. It ingests data from external, untrusted sources such as news articles and transcripts (via subagents and Perplexity). An attacker could place a 'SKILL_UPDATE_NEEDED' trigger inside a news article or SEC filing exhibit to trick the agent into autonomously rewriting its own rules or scripts without user intervention.
[PROMPT_INJECTION]: The mandatory evidence chain for Category 8 (Indirect Prompt Injection) is as follows:
Ingestion points: Data entering through 'neo4j-news', 'neo4j-transcript', and 'mcp__perplexity__perplexity_search' (File: SKILL.md).
Boundary markers: None identified; external data is processed directly for surprise calculations and skill updates.
Capability inventory: 'Bash' execution (Step 11), 'Edit' tool (Skill Updates), and 'Write' tool (Saving reports) (File: SKILL.md).
Sanitization: No evidence of sanitization or escaping of external content before processing or using it to trigger self-updates.

earnings-attribution