The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill retrieves headlines and filings from Yahoo Finance and SEC EDGAR servers. These are well-known, authoritative financial data sources.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text from external RSS and Atom feeds. Ingestion points: news.py (parse_rss and parse_sec_atom). Boundary markers: none. Capability inventory: reads local trader/ watchlist and plan files, executes network GET requests to finance APIs, and writes to a local state file. Sanitization: none. This creates a surface where a malicious news headline could attempt to influence the agent's behavior. The impact is minimized by specific instruction-layer constraints such as quoting sources and avoiding predictions.
[DATA_EXFILTRATION]: Stock symbols from local watchlist and portfolio files are transmitted as URL parameters to Yahoo and SEC servers. This is functional behavior necessary for ticker-specific news monitoring and does not expose sensitive user secrets or credentials.

trader-news