The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes network requests to Google Finance to retrieve financial data.
Evidence: The script scripts/fetch_gfinance.py performs POST requests to https://www.google.com/finance/beta/_/FinHubUi/data/batchexecute.
Note: Google is a well-known service, and these operations are central to the skill's stated purpose.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it fetches and processes untrusted content from external news sources and company profiles.
Ingestion Points: scripts/fetch_gfinance.py (via the news, news-related, and description modes) retrieves external text data.
Boundary Markers: Absent. The script does not wrap fetched content in delimiters or include instructions for the agent to ignore embedded commands.
Capability Inventory: The skill can perform network operations and write data to local files via the -o flag.
Sanitization: Absent. The script returns parsed JSON content directly without filtering or escaping potentially malicious instructions embedded in news headlines or descriptions.

google-finance