The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/analyze_shutdown.py contains a hardcoded API key (b36495528d4933449ac821a9fa35852d) used for authenticating requests to the Federal Reserve Economic Data (FRED) API. Hardcoding secrets in source files exposes them to unauthorized use and is a violation of secure credential management practices.\n- [PROMPT_INJECTION]: The SKILL.md file contains instructions in the 'Onboarding Guidance' section that attempt to constrain the agent's autonomy. Specifically, it directs the agent to guide users toward one specific question and explicitly commands the agent to 'Do NOT suggest other questions or broad explorations,' which overrides the agent's standard conversational capabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the external FRED API to generate liquidity analysis, which creates a surface for indirect prompt injection if the external source were to contain malicious content.\n
Ingestion points: Data is fetched from api.stlouisfed.org in the fetch_fred_data function within scripts/analyze_shutdown.py.\n
Boundary markers: The instructions lack delimiters or explicit warnings for the agent to ignore potentially malicious instructions embedded in the retrieved financial data.\n
Capability inventory: The skill has network access via the requests library and the ability to write analysis results and visualization images to the local file system.\n
Sanitization: While the script performs numeric data conversion, it does not include sanitization or validation logic to filter out non-numeric or instructional content from the API response.\n- [EXTERNAL_DOWNLOADS]: The skill makes network requests to the Federal Reserve Bank of St. Louis (FRED) API at api.stlouisfed.org to retrieve economic time series data. This is a well-known and authoritative source for financial data.

us-gov-shutdown-tracker