The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions direct the user to run npx @openfinclaw/cli@latest install and npx @openfinclaw/cli serve. These commands download and execute JavaScript code from the npm registry. While this is the intended installation method for the tool, it represents a remote code execution surface.
[EXTERNAL_DOWNLOADS]: The skill uses the fork and download commands to retrieve quantitative strategies and research packages from the vendor's domains (hub.openfinclaw.ai and gateway.openfinclaw.ai) to the local filesystem.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted market data, sentiment analysis, and community strategies to generate trading code and research summaries, creating a surface for indirect prompt injection.
Ingestion points: fin_deepagent_research_poll, strategy_fork, and fin_deepagent_download_package retrieve data from hub.openfinclaw.ai and gateway.openfinclaw.ai.
Boundary markers: No specific delimiters or safety instructions are defined to separate external data from agent prompts.
Capability inventory: The skill possesses file writing capabilities (fork, download), network access (api, research_submit), and the ability to execute CLI commands via the served MCP tools.
Sanitization: The skill does not provide mechanisms for sanitizing or validating the external data before it is processed by the agent.

openfinclaw-ai-quant-research