The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external files (CSV or JSON) that could contain malicious instructions. If an attacker controls the input metrics file, they could attempt to influence the agent's reporting behavior through malicious text in ticker names or company descriptions.
Ingestion points: screen.py reads data from files specified in the metrics argument (e.g., trader/metrics.json or arbitrary CSV files).
Boundary markers: The skill does not use specific delimiters or instructions to warn the agent about potentially malicious content embedded in the metrics data.
Capability inventory: The skill utilizes screen.py to read metrics and prices, and can write output to the file system using the --out parameter (e.g., trader/shortlist.json).
Sanitization: While the script validates numeric metrics, it does not sanitize or escape string fields (like ticker or name) that are rendered in the final report.

trader-screener