The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses a custom script, fetch-public.js, to download financial documents. This script implements several security checks, including blocking access to local/private IP addresses (SSRF protection) and stripping sensitive query parameters from URLs.
[COMMAND_EXECUTION]: The skill utilizes the @nomadamas/k-skill CLI tool for management and execution. This tool is provided by the skill author and is used to fetch instructions and run verification scripts.
[INDIRECT_PROMPT_INJECTION]: As the skill ingests external filings, it maintains a vulnerability surface for indirect prompt injection.
Ingestion points: External HTML and JSON data are fetched via fetch-public.js and read by evidence.js and dart-rows.js.
Boundary markers: The instruction.md file contains explicit directives to treat external content as data and not as instructions.
Capability inventory: The skill has capabilities for network access (fetch), file system access (readFileSync, writeFileSync), and subprocess execution in tests.
Sanitization: The skill uses strict JSON parsing and HTML entity decoding, and implements an "evidence gate" in evidence.js that requires every claim in the chat output to match a verbatim excerpt from the raw source files.
[SAFE]: The skill follows security best practices for file management. The evidence.js script includes robust checks to prevent path traversal by validating relative paths and using realpathSync to ensure operations remain within the designated snapshot directory.

company-analysis