The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill communicates with well-known official domains (sec.gov and data.sec.gov) to retrieve public financial data. It requires a User-Agent containing an email address, which is a specific requirement of the SEC's fair access policy for their APIs and does not constitute unauthorized exfiltration.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (SEC XBRL facts and company filings). Although this is an attack surface, the risk is minimal as the script focuses on structured data parsing and does not possess high-risk capabilities like arbitrary command execution or external network reporting of private files.
[REMOTE_CODE_EXECUTION]: The provided facts.py script relies exclusively on Python's standard library. It does not download or execute external scripts, nor does it use dynamic execution functions like eval() or exec().
[COMMAND_EXECUTION]: The skill's instructions involve running the local facts.py script with controlled arguments. There are no patterns suggesting arbitrary shell command injection or exposure to untrusted user input that could lead to command execution.

trader-analyst