The Agent Skills Directory

[PERSISTENCE]: The skill provides a command (FL daemon <name> --install) to establish persistence on the host system. It supports creating LaunchAgents on macOS, systemd user units on Linux, and Scheduled Tasks on Windows to ensure the trading agent remains active across system restarts.
[INDIRECT_PROMPT_INJECTION]: The skill reads external data from the feast.meme service, specifically a "public notes feed" that includes messages written by other players. Because the agent has the capability to perform financial transactions (FL buy, FL sell) based on its strategy, this ingested data constitutes an indirect prompt injection surface. The skill instructions attempt to mitigate this by directing the agent to treat these fields as untrusted data.
[DATA_EXFILTRATION]: The FL report command facilitates the transmission of local diagnostic data to a remote server at feast.meme. This data includes the output of system checks and the last 200 lines of logs. While the documentation states that sensitive information such as keys and full addresses are redacted, the functionality represents a mechanism for exporting local information.
[DYNAMIC_EXECUTION]: The skill allows for the execution of custom JavaScript strategy scripts through an "Advanced track." To mitigate the risks of executing user-provided code, the skill utilizes a sandbox environment that restricts access to the network, environment variables, and the file system.
[REMOTE_CODE_EXECUTION]: The skill features an FL upgrade command that downloads and installs updates to its runtime from a remote repository. This is a mechanism for remote code execution, used here for legitimate maintenance and feature updates.
[EXTERNAL_DOWNLOADS]: The skill's setup and maintenance procedures involve downloading the runtime environment and its dependencies from external sources, including GitHub and the official Node.js distribution site.

feast-league