The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads financial data from well-known and reputable services including the Federal Reserve Economic Data (FRED) and MacroMicro.
Evidence: Requests to https://fred.stlouisfed.org/graph/fredgraph.csv and https://www.macromicro.me/charts/46877/cass-freight-index.
[DYNAMIC_EXECUTION]: The skill executes JavaScript within a browser environment to extract data from Highcharts visualizations. While this is used for legitimate scraping of single-page applications, it involves the execution of code in a browser context.
Evidence: Use of driver.execute_script() in Selenium and Runtime.evaluate via the Chrome DevTools Protocol (CDP) in scripts/fetch_cass_freight.py and scripts/fetch_via_cdp.py.
[COMMAND_EXECUTION]: The instructions require the user to execute shell commands to launch the Google Chrome browser with remote debugging enabled (--remote-debugging-port=9222). This configuration allows the skill's Python scripts to control the browser.
Evidence: SKILL.md quick start instructions for Windows and macOS.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from the web (MacroMicro and FRED) and translates it into analytical reports. If these data sources were compromised, they could provide malicious instructions that the agent might follow.
Ingestion points: scripts/fetch_cass_freight.py (Highcharts data), scripts/freight_inflation_detector.py (FRED CSV data).
Capability inventory: The skill has the ability to write files (JSON, CSV, PNG) and perform network requests.
Sanitization: Data is parsed using standard tools (json.loads, pd.read_csv, pd.to_numeric), but no explicit protection against prompt injection in the data values is present.
Boundary markers: Absent; data is directly incorporated into analysis prompts.

detect-freight-led-inflation-turn