The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions for installing the finlab package and broker-specific SDKs (esun-trade, shioaji) using the uv and pip package managers. These are legitimate dependencies required for the skill's stated purpose of quantitative trading and market analysis.
[CREDENTIALS_UNSAFE]: The documentation includes detailed instructions for configuring API keys and secrets for various brokerage accounts (Sinopac, Esun, Masterlink, Fubon). The instructions correctly advise users to use secure environment variables and platform-specific secret storage, explicitly warning against committing secrets to code or pasting them into chats.
[INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting and processing external financial market data (prices, fundamentals, institutional trading) through the data.get() API. While this creates a data ingestion surface, it is a primary functional requirement of the skill, and the processed data is typically structured numerical data used for mathematical modeling rather than natural language instructions.
[DYNAMIC_EXECUTION]: The Report.from_pickle() method is documented for loading saved backtest results. While pickle can be used for local persistence, users should be aware that loading pickle files from untrusted sources is a potential risk, although here it is presented as a utility for managing the user's own data.

finlab