The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides setup instructions for the official Alpaca MCP server from its GitHub repository and the uv tool from Astral. These are well-known technology providers and the references are used for legitimate configuration purposes.
[COMMAND_EXECUTION]: Includes a Python script (ticket.py) for managing order state and logs. The script uses standard libraries to read and write local JSON files within the skill's directory structure and does not perform any unexpected system operations.
[INDIRECT_PROMPT_INJECTION]: Processes trade orders and user approval messages. Security is maintained through a strict validation logic in ticket.py that checks for explicit confirmation words and matches order symbols and amounts, preventing accidental or manipulated order execution.
[DATA_EXPOSURE]: Implements best practices for secret management. The documentation explicitly instructs users to store API keys in local configuration files and provides strong warnings against sharing credentials within the conversation or reading sensitive files into the chat context.

trader-broker