The Agent Skills Directory

[DYNAMIC_EXECUTION]: The documentation includes a code snippet demonstrating unsafe practices that utilizes pickle.load() to deserialize a model file. Although the skill explicitly marks this as the "WRONG" way to deploy, the presence of unsafe deserialization code in a template remains a risk as it provides a functional pattern for a dangerous operation that can lead to arbitrary code execution if the source file is compromised.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion and processing of external market data from services like Alpaca, which represents a potential attack surface for indirect injection if malicious or malformed data is introduced.
Ingestion points: The skill uses AlpacaDataFeed in SKILL.md to fetch live market data for the strategy engine.
Boundary markers: The skill advocates for the use of LiveRiskConfig and a SafeBroker wrapper to enforce hard limits and boundaries on the strategy's actions, independent of the input signals.
Capability inventory: The skill employs AlpacaBroker (for order execution) and LiveEngine (for strategy management), both of which possess significant system and financial capabilities.
Sanitization: The implementation requires data freshness checks (staleness threshold) and schema validation (validate_schema) before data is passed to the model.

ml4t-production-readiness