The Agent Skills Directory

[COMMAND_EXECUTION]: The helper scripts scripts/query.sh and scripts/query.cmd are vulnerable to command injection. In scripts/query.sh, the user-provided query is interpolated into a shell heredoc (cat <<EOF), which causes the shell to evaluate and execute any commands enclosed in $(...) or backticks within the query string before sending the request. In scripts/query.cmd, the unsafe expansion of the %QUERY% variable allows for the execution of arbitrary commands using shell metacharacters like & if the input is not carefully sanitized.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it retrieves and processes external financial data from sources like news articles and company announcements. Ingestion points: Untrusted external data enters the agent's context through the content fields in the apiRecall and docList objects described in reference.md. Boundary markers: No delimiters or isolation techniques are employed to distinguish external data from system instructions. Capability inventory: The skill has the capability to perform network requests and execute shell commands through the included scripts. Sanitization: There is no evidence of content validation or sanitization performed on the data fetched from the remote API before it is processed by the agent.
[EXTERNAL_DOWNLOADS]: The skill communicates with a remote API at https://jprx.m.qq.com via a local proxy. This domain is managed by a well-known technology service provider (Tencent) and is used for fetching real-time financial data.
[PROMPT_INJECTION]: The SKILL.md instructions include strong, authoritative constraints that mandate the use of this skill and prohibit the use of the agent's internal training data for financial queries, which overrides the agent's default decision-making logic regarding data sourcing.

neodata-financial-search