The Agent Skills Directory

[DATA_EXFILTRATION]: The tools extract_shadow_strategy and run_shadow_backtest accept a journal_path parameter. This interface presents a risk of path traversal if the backend system does not strictly validate that the provided path points to an authorized trade journal, potentially allowing unauthorized reading of sensitive files on the local filesystem.
[COMMAND_EXECUTION]: The render_shadow_report tool generates HTML and PDF reports based on data extracted from user-supplied journals. If this data is not properly sanitized before being rendered, it could lead to injection vulnerabilities within the document generation engine (such as WeasyPrint) or the resulting HTML/PDF files.
[PROMPT_INJECTION]: The skill utilizes a 'Rule Translation Prompt Template' that interpolates data derived from trade journals (e.g., market names, entry hours) into LLM instructions. If a trade journal contains maliciously crafted data, it could attempt to manipulate the LLM's output or bypass the constraints of the translation task.

shadow-account