The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the yfinance package from the public Python Package Index (PyPI). This is a well-known service and the package is standard for its stated purpose of financial data retrieval.
[COMMAND_EXECUTION]: The skill uses subprocess.check_call to install dependencies via pip and executes a Python version check through a shell command. These are standard administrative tasks for environment setup.
[DYNAMIC_CONTEXT_INJECTION]: The SKILL.md file uses the !command`` syntax to run a Python script at load time to verify the installation of yfinance. This is used for configuration and does not access sensitive system files.
[DYNAMIC_EXECUTION]: The version check command uses the exec() function to run a hardcoded Python snippet. This code is internal to the skill and does not process untrusted external data at that stage.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from Yahoo Finance through the yfinance library as seen in SKILL.md. This ingestion point lacks explicit boundary markers or sanitization for external content, creating an attack surface where instructions embedded in financial data could influence the agent. However, the skill's capabilities are focused on data analysis and tabulation, minimizing the risk of exploitation.

estimate-analysis