The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes the WebFetch tool to retrieve 12-month stock price returns from external financial data sources. This is a functional requirement to provide performance context in the scorecard.
[COMMAND_EXECUTION]: The skill orchestrates data processing by spawning the marketcheck-cowork-plugin:cohort-benchmarking-agent. This plugin is used to fetch large-scale cohort data and compute statistical quintile thresholds, which is the primary purpose of the skill.
[DATA_EXPOSURE]: The skill reads from a local project memory file, marketcheck-profile.md, to extract user preferences such as tracked_tickers and country. This allows the agent to tailor its analysis to the user's specific interests.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes data from untrusted external sources.
Ingestion points: External content is ingested via the WebFetch tool and the marketcheck-profile.md file.
Boundary markers: The skill does not define explicit delimiters or instructions to ignore embedded commands within the fetched external data.
Capability inventory: The agent can spawn secondary agents and perform tool-based data lookups.
Sanitization: No specific sanitization or filtering is applied to the external web data before it is included in the narrative generation. This risk is considered minimal and inherent to the functionality of web-searching agents.

public-group-scorecard