The Agent Skills Directory

[COMMAND_EXECUTION]: The DataManager.query method and its convenience wrappers (query_market, query_factor_tests, query_backtests) in data_manager.py are vulnerable to SQL injection. They perform direct string interpolation of parameters like sql and sql_where into SQL statements executed by the DuckDB engine. If these parameters contain untrusted input, an attacker could execute arbitrary SQL commands to manipulate data, read unauthorized files, or potentially make outbound network requests using DuckDB's native extensions.
[DATA_EXFILTRATION]: Multiple methods in data_manager.py, including read_symbol, save_symbol, list_symbols, and import_symbol_csv, are vulnerable to directory traversal. The frequency and symbol parameters are appended to the workspace root using the / operator without validation. An attacker providing values like ../../etc for frequency could cause the agent to read from or write to sensitive locations outside the intended data directory.
[DYNAMIC_EXECUTION]: The DataManager.query implementation in data_manager.py dynamically constructs SQL strings by replacing the {data} placeholder with the local filesystem path. This pattern of raw string manipulation for executable code, without using parameterized queries for all user-controllable segments, constitutes unsafe dynamic execution.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Parquet and CSV files across several functions in data_manager.py (e.g., read_symbols, import_combined_csv, query).
Ingestion points: Data enters the agent context through pd.read_parquet, pd.read_csv, and duckdb.query calls.
Boundary markers: None. The skill does not implement delimiters or provide instructions for the agent to ignore natural language instructions found within the market data or factor reports.
Capability inventory: The skill possesses significant capabilities including arbitrary file reading/writing via pandas and powerful database operations via duckdb.
Sanitization: While the namespaced_artifact_dir method implements path validation, the primary data loading and querying entry points lack input sanitization or schema enforcement, leaving the agent vulnerable to instructions embedded in the ingested data.

store