The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection because it processes data from external APIs and user-provided CSV files while possessing file-writing capabilities.
Ingestion points: Financial data is ingested via Alpaca MCP tools (get_positions) and manual CSV entry described in README.md.
Boundary markers: The skill does not define specific delimiters or instructions to the agent to disregard potential instructions embedded within the ingested financial data.
Capability inventory: The skill is capable of writing markdown reports to the repository root (SKILL.md Step 6) and performing web searches for ticker enrichment.
Sanitization: No explicit data validation or sanitization routines are defined for the external data inputs.
[COMMAND_EXECUTION]: The skill includes a Python utility check_alpaca_connection.py intended for local environment verification. The script performs legitimate API requests to official Alpaca domains and contains no suspicious command execution or obfuscated logic.
[CREDENTIALS_UNSAFE]: The skill documentation provides appropriate guidance for managing sensitive Alpaca API keys using environment variables and secure local configuration files (~/.alpaca/config.ini), avoiding the risk of hardcoded credentials.

portfolio-manager