The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill is configured to fetch market breadth data from external URLs. Automated security scans have identified https://tradermonty.github.io/market-breadth-analysis/market_breadth_data.csv as a blacklisted malicious URL. Interacting with blacklisted domains poses a high risk of malware delivery or data poisoning.
[REMOTE_CODE_EXECUTION]: The script scripts/fetch_breadth_csv.py has been flagged as malicious (FileRepMalware) by file reputation scanners. This script is responsible for downloading data from untrusted external sources and processing it within the agent's environment, which could facilitate the execution of malicious payloads.
[COMMAND_EXECUTION]: The skill instructions (README.md and SKILL.md) mandate the execution of several local Python scripts, including the flagged fetch_breadth_csv.py, using the python3 command. This grants the skill the ability to execute arbitrary logic on the host system as part of its standard workflow.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection by ingesting and analyzing untrusted external data.
Ingestion points: Data is retrieved from the tradermonty.github.io domain and raw.githubusercontent.com via fetch_breadth_csv.py. Additionally, user-supplied images are processed using OpenCV and PIL in detect_breadth_values.py, detect_uptrend_ratio.py, and extract_chart_right_edge.py.
Boundary markers: There are no defined boundary markers or instructions for the agent to ignore potentially malicious instructions embedded within the CSV data or text extracted from images.
Capability inventory: The skill has the capability to write files (analysis reports) to the reports/ directory and perform network requests, which could be abused if malicious instructions are successfully injected via external data.
Sanitization: The analysis scripts do not appear to implement sanitization or filtering logic to prevent the processing of malicious payloads hidden within the numerical data or image metadata.

breadth-chart-analyst