The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the pywencai Python package and Node.js v16+. While pywencai is a common tool for this specific purpose, downloading and executing external packages introduces a dependency on third-party code integrity.
[INDIRECT_PROMPT_INJECTION]: The skill processes natural language query results from the WenCai website. If an attacker could influence the data returned by the website (e.g., through stock descriptions or news titles), they could theoretically attempt to inject instructions into the agent's context. However, the risk is assessed as LOW due to the structured nature of the financial data returned.
[COMMAND_EXECUTION]: The skill documentation suggests installing packages via pip install, which is a standard procedure for Python-based skills and does not escalate the verdict beyond the external download risk.

pywencai