The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill uses npx -y md-to-pdf as a fallback mechanism for PDF generation. This downloads and executes a tool from the npm registry at runtime without specific version pinning, representing an unverified dependency execution.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute a bundled Python script (scripts/data_fetcher.py) for A-share data and system-level commands (e.g., Google Chrome headless) for converting generated reports to PDF format.
[PROMPT_INJECTION]: The skill processes untrusted content from news sources and company websites, creating a surface for indirect prompt injection.
Ingestion points: WebSearch and WebFetch results from financial news platforms and corporate websites in Phase 1 (Agents 2 and 5).
Boundary markers: The agent instructions define roles but do not include explicit delimiters or warnings to ignore malicious instructions embedded within the fetched data.
Capability inventory: Access to Bash (command execution) and Write (file system access) tools.
Sanitization: No explicit input validation or sanitization of external content is specified before processing.
[EXTERNAL_DOWNLOADS]: The skill fetches data from financial portals (Yahoo Finance, Bloomberg, etc.) and corporate websites. It also suggests runtime installation of Python libraries (akshare, pandas) to support A-share data fetching.

analyze-stock