The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from external API endpoints (KuCoin market data, order history, and account balances), which represents a surface for indirect prompt injection where malicious instructions could theoretically be embedded in data returned by the API.
Ingestion points: API responses from https://api.kucoin.com as defined in SKILL.md and references/authentication.md.
Boundary markers: None identified in the provided instructions.
Capability inventory: Shell command execution (curl, openssl) and Python script execution (requests) as documented in references/authentication.md.
Sanitization: No explicit sanitization, schema validation, or escaping of the ingested API data is specified in the instructions.
[COMMAND_EXECUTION]: The authentication documentation (references/authentication.md) provides bash script examples that utilize system commands including curl, openssl, and python3 -c to generate HMAC-SHA256 signatures and interact with the vendor's API.
[DYNAMIC_EXECUTION]: The skill includes reference implementations in Python and Bash for the signing process. While these are necessary for the primary purpose of authenticated trading, they involve the generation and execution of logic to handle sensitive credentials and network requests.

margin-trading