The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The HTTP client in scripts/_client.py explicitly disables SSL certificate validation and hostname checking, creating a risk during credential transmission.\n
Evidence: The script sets _ssl_ctx.check_hostname = False and _ssl_ctx.verify_mode = ssl.CERT_NONE when initializing the SSL context used for all API communication with open.gangtise.com.\n
Risk: This implementation allows for Man-in-the-Middle (MITM) attacks, which could be used to intercept sensitive API keys (GANGTISE_ACCESS_KEY and GANGTISE_SECRET_KEY) or manipulate the financial data returned by the service.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external research reports and meeting summaries, which could be exploited for indirect prompt injection.\n
Ingestion points: The skill fetches data from open.gangtise.com using scripts like scripts/query_kb.py, scripts/meeting_list.py, and scripts/indicator.py.\n
Boundary markers: There are no delimiters or specific instructions to the agent to ignore embedded commands within the tool outputs returned in mcp-server/server.py.\n
Capability inventory: The skill has capabilities for network communication and file system writes (via scripts/download_resource.py).\n
Sanitization: While scripts/clean_md.py removes HTML tags, it does not sanitize the text content for malicious instruction-like patterns.\n- [EXTERNAL_DOWNLOADS]: The skill provides functionality to download external resources to the local file system.\n
Evidence: scripts/download_resource.py contains logic to download PDF reports and binary data from the Gangtise API and save them locally.\n
Risk: The script determines local filenames using the Content-Disposition header from the server without robust path validation, which could theoretically be exploited if the source domain were compromised.\n- [COMMAND_EXECUTION]: The skill instructions encourage the execution of local setup scripts for configuration.\n
Evidence: SKILL.md and mcp-server/README.md direct users to run python3 scripts/configure.py to manage API credentials.

gangtise-kb