The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill suggests downloading an OpenAPI specification file from a remote server to update its internal documentation.
Evidence: curl -fsSL https://www.tradingviewapi.com/openapi.json -o /tmp/tradingview-openapi.json in SKILL.md.
Context: This is a standard practice for maintaining up-to-date API integration and the source domain is the official endpoint for the service described in the skill.
[INDIRECT_PROMPT_INJECTION]: The skill processes financial news and community trading ideas which are retrieved from external API endpoints.
Ingestion points: News titles, descriptions, and community 'minds' or ideas are fetched via GET /api/news and GET /api/ideas (referenced in 06-news.md and 13-ideas.md).
Boundary markers: The instructions do not define clear delimiters or include warnings for the agent to ignore instructions embedded within the news/idea text.
Capability inventory: The agent has access to scripts/tv_api.py, which uses urllib.request to perform arbitrary GET and POST network operations to the configured API backend.
Sanitization: There is no evidence of sanitization or filtering of the external content before it is processed by the agent.
Context: Since this data originates from third-party contributors on the TradingView platform, it represents an untrusted data stream that could contain prompt injection patterns.

tradingview-api-integration