The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes system commands for environment discovery and installation across Windows, macOS, and Linux.
Detects the operating system using uname -s and /etc/os-release.
Identifies locally installed software versions using registry queries on Windows, defaults read on macOS, and file searches on Linux.
[EXTERNAL_DOWNLOADS]: Fetches software archives and installer packages from official vendor domains.
Downloads installers from moomoo.com and softwaredownload.moomoo.com.
Queries version information from futunn.com (a related vendor service).
[REMOTE_CODE_EXECUTION]: Automatically executes downloaded installers and setup scripts.
Launches .exe installers on Windows via PowerShell.
Mounts .dmg images and copies app bundles on macOS.
Installs .deb and .rpm packages on Linux systems.
Upgrades the Python SDK and common data science libraries using pip.
[PRIVILEGE_ESCALATION]: Utilizes elevated permissions and modifies security attributes during the installation process.
Uses sudo on Linux to install system packages via dpkg or rpm.
Bypasses macOS Gatekeeper protections by removing the com.apple.quarantine attribute from installed applications.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for command injection via user-provided parameters.
Ingestion points: Accepts a custom download path through the -path parameter in $ARGUMENTS (SKILL.md).
Boundary markers: The instructions define parsing rules but do not provide explicit sanitization or escaping guidelines for the path string.
Capability inventory: The skill uses Bash, Write, and powershell to execute commands that incorporate this user-provided path across multiple installation scripts.
Sanitization: There is no evidence of path validation or sanitization logic in the provided scripts, which could allow command injection if the agent interpolates malicious path strings into shell commands.

install-moomoo-opend