The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches installation scripts for the required moomoo CLI from the vendor's official GitHub repository (MoomooOpen/moomoo-cli).
[REMOTE_CODE_EXECUTION]: The installation instructions include patterns to download and execute scripts directly from the network.
Evidence: curl -fsSL https://raw.githubusercontent.com/MoomooOpen/moomoo-cli/main/scripts/install.sh | sh in SKILL.md.
Evidence: iwr ... install.ps1 followed by execution via PowerShell in SKILL.md.
These are official installation methods provided by the vendor for the necessary CLI dependency.
[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to interact with the local moomoo CLI to perform simulated trading tasks like order placement and account queries.
[PRIVILEGE_ESCALATION]: On Windows systems, the installation instructions utilize powershell -ExecutionPolicy Bypass. This is a standard procedure for installing development tools but involves bypassing local script execution restrictions.
[DATA_EXFILTRATION]: The skill includes security-conscious instructions to prevent the exposure of sensitive credentials.
Evidence: Explicitly instructs the agent to never read or print token file contents, relying instead on the CLI's internal handling of OAuth Bearer authentication.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from markets and CLI outputs which could theoretically contain malicious instructions.
Ingestion points: User-supplied ticker symbols and JSON outputs from the moomoo CLI (found in SKILL.md and references/cli-parameters.md).
Boundary markers: Includes a dedicated 'Boundary With Real Trading' section and specific 'Rules' to ensure the agent does not confuse simulated commands with real securities trading.
Capability inventory: Uses Bash for CLI operations and Read for documentation access.
Sanitization: Instructions require ticker normalization (e.g., converting 700 to HK.00700) and mandate explicit user confirmation before placing, modifying, or canceling any simulated orders.

moomoo-sim-trading