The Agent Skills Directory

[OBFUSCATION]: The installation instructions in SKILL.md contain a command for Windows users that uses non-breaking hyphens (U+2011) instead of standard ASCII hyphens (U+002D) in the filename TA_Lib‑0.4.28‑cp311‑cp311‑win_amd64.whl. This is a substitution of confusable characters within a command context.
[INDIRECT_PROMPT_INJECTION]: The skill ingests historical market data from an external API, creating a surface for indirect prompt injection.
Ingestion points: Historical market data is fetched from the OpenAlgo API using client.history() in the scripts indicators.py, scanner.py, and signals.py.
Boundary markers: The skill lacks explicit delimiters or instructions to ignore potential commands embedded in data returned by the API.
Capability inventory: The skill includes network access to the API host and the ability to save analysis results to local CSV files.
Sanitization: No specific sanitization or validation of the content of the API response was observed.
[EXTERNAL_DOWNLOADS]: The documentation directs users to download binary Python wheels from an external university domain (lfd.uci.edu). While this is a known source for Windows binaries of scientific libraries, it involves installing third-party binary executables.

technical-indicators