The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external market API responses and user-defined trading symbols.
Ingestion points: User-provided symbols and parameters via CLI arguments in scripts/candlestick.py and scripts/payoff.py, and sidebar inputs in the Streamlit dashboard template in SKILL.md.
Boundary markers: No delimiters or instructions are used to separate ingested data from agent commands during processing.
Capability inventory: Network communication with the OpenAlgo API, file writing (HTML charts), and real-time dashboard rendering via Streamlit.
Sanitization: Parameters such as exchange and interval are validated using predefined choices in the script arguments.
[CREDENTIALS_UNSAFE]: The skill correctly uses placeholders and environment variables to manage sensitive API keys, avoiding hardcoded credentials.
Evidence: Documentation in SKILL.md uses 'your_api_key_here' and 'your_key' as placeholders. Scripts in the scripts/ directory utilize os.environ.get() for retrieving secrets at runtime.
[SAFE]: The primary functionality involves data analysis and visualization using well-known, legitimate libraries. No malicious obfuscation, persistence, or privilege escalation mechanisms were identified.

visualization