The Agent Skills Directory

[SAFE]: Command Execution Security
The script scripts/open_finviz_screener.py utilizes subprocess.run to open the constructed URL in Google Chrome or a fallback browser.
The script correctly uses a list of arguments rather than a shell string and avoids shell=True, which prevents shell-based command injection.
[SAFE]: Input Validation and Sanitization
Every user-supplied parameter, including filters, themes, sub-themes, and sort orders, is passed through rigorous validation using restrictive regular expressions (_TOKEN_RE, _SLUG_RE, _ORDER_RE).
These checks ensure that only safe characters (lowercase letters, digits, underscores, dots, and hyphens) are accepted, effectively blocking characters used for command or URL parameter injection.
[SAFE]: Credential Management
The skill uses the FINVIZ_API_KEY environment variable purely for feature detection (switching between public and Elite FinViz URLs).
There is no evidence of hardcoded credentials or data exfiltration routines; the key is accessed locally and never transmitted to external servers by the skill's code.
[SAFE]: Data Ingestion and Mapping
The skill employs a static reference file (references/finviz_screener_filters.md) to map natural language to specific tokens. The logic ensures that the agent follows a strict translation process, and the subsequent script validation provides a secondary layer of protection against indirect prompt injection.

finviz-screener