The Agent Skills Directory

[SAFE]: The skill implements a comprehensive 6-step Safety Protocol for all financial operations, including explicit user confirmation, duplicate order detection, and market session validation.\n- [SAFE]: Integrated daily 2FA OTP session management ensures that write operations (place, modify, cancel) require a fresh authentication token, protecting against unauthorized access.\n- [COMMAND_EXECUTION]: The skill executes a local script ./finhay.sh for all API calls and signing logic. While the script source is not provided in the bundle, its usage is strictly controlled by the agent's safety instructions.\n- [EXTERNAL_DOWNLOADS]: A sync command is mentioned in the CLI reference for updating skill definitions. This represents a potential external update mechanism, though no specific untrusted URLs are provided.\n- [NO_CODE]: The core logic for signing and communicating with the Finhay API is encapsulated in the ./finhay.sh script, which is referenced throughout the skill but not included in the provided package.\n- [SAFE]: Indirect Prompt Injection risk: 1. Ingestion point: references/endpoints/order-book.md (feedback message). 2. Boundary markers: Absent. 3. Capability inventory: Order placement and modification via ./finhay.sh. 4. Sanitization: Absent. The risk is mitigated by the mandatory 6-step safety protocol and explicit confirmation requirements.

finhay-trading