The Agent Skills Directory

[SAFE]: The skill and the provided lots.py script utilize only the Python standard library. No external dependencies are imported, and no network operations (like curl, requests, or urllib) are present in the code.
[COMMAND_EXECUTION]: The skill executes a bundled Python script (lots.py) to perform its arithmetic. The script is designed for data processing and does not use dangerous functions such as eval(), exec(), or os.system() to process user input or external data.
[INDIRECT_PROMPT_INJECTION]: The skill implements a data ingestion surface and write capabilities:
Ingestion points: Reads stock positions and prices from trader/portfolio.json and trader/prices.json.
Boundary markers: None (the skill processes raw JSON data fields).
Capability inventory: Writes proposed orders to trader/orders.json and logs sales to trader/state/tax.json. No network or subprocess capabilities exist.
Sanitization: Ticker symbols are forced to uppercase and validated against internal stock family lists. The resulting output is structured as a proposal for the user, mitigating the risk of instructions embedded in the source data influencing the agent.

trader-tax