The Agent Skills Directory

[DYNAMIC_CONTEXT_INJECTION]: The skill uses the !command`` syntax to execute a shell command at the time the skill is loaded. This is used to verify the availability of the yfinance package in the environment.
Evidence: The script block starting with !python3 -c "exec(...)"inSKILL.md`.
[DYNAMIC_EXECUTION]: The command used for the environment check utilizes the Python exec() function to execute logic defined within a string.
Evidence: The inclusion of exec() within the Python one-liner in the SKILL.md file.
[INDIRECT_PROMPT_INJECTION]: The skill processes financial data retrieved from Yahoo Finance, which is an external untrusted source. This presents a potential surface for instructions embedded in data to influence the agent.
Ingestion points: Data is fetched via ticker.info, ticker.earnings_estimate, ticker.recommendations, and other methods in SKILL.md.
Boundary markers: No explicit boundary markers or instructions to ignore data-embedded commands are provided.
Capability inventory: The skill can execute shell commands for package management and perform network requests through libraries.
Sanitization: The retrieved data is formatted into tables without explicit validation or escaping of the content.
[EXTERNAL_DOWNLOADS]: The skill contains logic to install the yfinance library from the public Python Package Index (PyPI) if it is missing.
Evidence: The subprocess.check_call logic in SKILL.md which invokes pip install.

earnings-preview