The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions provide commands to download and execute installation scripts directly from the vendor's GitHub repository to set up the necessary CLI environment.
Evidence: curl -fsSL https://raw.githubusercontent.com/MoomooOpen/moomoo-cli/main/scripts/install.sh | sh in SKILL.md for Linux/macOS.
Evidence: iwr -UseBasicParsing https://raw.githubusercontent.com/MoomooOpen/moomoo-cli/main/scripts/install.ps1 -OutFile install.ps1 followed by script execution in SKILL.md for Windows.
[PRIVILEGE_ESCALATION]: The Windows installation workflow involves bypassing the PowerShell execution policy to run the vendor-provided installer script.
Evidence: powershell -ExecutionPolicy Bypass -File .\install.ps1 in SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill processes user input (symbols, quantities, prices) to build CLI commands executed via Bash, creating a potential surface for command injection if parameters are not strictly validated.
Ingestion points: User-provided values for trading orders defined in SKILL.md and references/cli-parameters.md.
Boundary markers: No explicit delimiter markers are used for command interpolation, though hidden internal markers like --source skill are appended.
Capability inventory: The skill relies on the Bash tool to execute moomoo CLI commands with full system interaction.
Sanitization: The instructions mandate normalization of symbols to the MARKET.CODE format and uppercasing of tickers, which serves as a basic validation layer.
[COMMAND_EXECUTION]: The core functionality of the skill is built around executing a local binary (moomoo) with various flags to perform sensitive financial operations.

moomoo-trading