The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches installation scripts and updates from the vendor's official GitHub repository.\n
Evidence: https://raw.githubusercontent.com/MoomooOpen/moomoo-cli/main/scripts/install.sh and MoomooOpen/moomoo-agent-hub are referenced in SKILL.md for tool setup and skill updates.\n- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and immediately execute shell scripts to install the required CLI binary.\n
Evidence: SKILL.md contains curl -fsSL ... | sh and powershell ... -File .\\install.ps1 commands.\n- [PRIVILEGE_ESCALATION]: The Windows installation instructions include bypassing the PowerShell execution policy to run the installer.\n
Evidence: Use of -ExecutionPolicy Bypass in the Windows setup block in SKILL.md.\n- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided symbols and order details to construct bash commands, creating an ingestion surface for potentially malicious data.\n
Ingestion points: User-supplied cryptocurrency symbols (e.g., BTCUSD) and order parameters in SKILL.md and references/cli-parameters.md.\n
Boundary markers: Absent; commands are constructed using direct interpolation of values into CLI flags.\n
Capability inventory: High-impact Bash tool usage for account listing, balance checks, and order placement/modification.\n
Sanitization: Instructions advise the agent to uppercase symbols and strip prefixes, but do not specify rigorous validation or escaping for all user-supplied command arguments.\n- [COMMAND_EXECUTION]: The skill relies on the Bash tool to interact with the local operating system through the moomoo CLI for sensitive financial and trading operations.

moomoo-crypto