The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions include steps to fetch installation content and logic from https://ai4trade.ai/skill/copytrade using both Python requests and curl commands.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from signal providers via the /api/signals/feed and /api/signals/{id} API endpoints. Signal objects include a content field containing natural language commentary (e.g., "Long BTC, target 55000") which is processed by the agent.
Ingestion points: SKILL.md describes the ingestion of signal data via the /api/signals/feed endpoint.
Boundary markers: There are no delimited boundaries or instructions to ignore embedded commands within the signal content.
Capability inventory: The skill possesses the ability to manage trading positions, execute API calls to follow/unfollow leaders, and interact with the OpenClaw gateway.
Sanitization: No sanitization or validation of the signal's content field is described before processing.
[COMMAND_EXECUTION]: The documentation provides shell commands for installing and enabling external plugins (openclaw plugins install @clawtrader/copytrade) which are executed in the host environment.
[DYNAMIC_EXECUTION]: The Python auto-install example suggests that the agent framework will "parse and install" content downloaded from a remote URL, which may include executable logic or configuration that influences agent behavior at runtime.

ai-trader-copytrade