The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/today_market_scan.py uses subprocess.run() to orchestrate the execution of internal scripts like fetch_live.py and scan_snapshot.py. This orchestration is handled using argument lists rather than shell strings, which prevents shell-based command injection.
[EXTERNAL_DOWNLOADS]: The skill fetches financial data from the Hong Kong Monetary Authority (HKMA) public API (api.hkma.gov.hk) and the vendor's market data service (pandadata.pandaaiquant.com). These are legitimate, purpose-specific endpoints required for the skill's primary functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external APIs and user-provided CSV files. This represents an attack surface where a poisoned data source could attempt to embed instructions. However, the scripts perform strict validation by casting input values to floats or dates, effectively neutralizing any non-numeric payload before it is processed or reported to the agent.
[DYNAMIC_EXECUTION]: Local script execution is used for workflow management. The agent uses sys.executable to run local Python scripts with programmatically defined arguments, following a least-privilege approach by not requiring broad shell access.

ah-share-relative-value-montior