The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to download a codebase from a third-party GitHub repository (https://github.com/jackson-video-resources/claude-tradingview-mcp-trading) that is not affiliated with the skill author or a well-known service provider.\n- [REMOTE_CODE_EXECUTION]: The installation process requires running npm install and node bot.js on the cloned external repository, leading to the execution of code from an unverified source.\n- [INDIRECT_PROMPT_INJECTION]: The skill implements a feature to extract trading strategies from YouTube transcripts, creating a vulnerability surface where malicious instructions could be embedded in the transcript data.\n
Ingestion points: External YouTube transcript data processed via Apify and provided to the agent as described in the SKILL.md instructions (referencing prompts/01-extract-strategy.md).\n
Boundary markers: Absent. The skill lacks explicit delimiters or instructions for the agent to ignore potentially malicious embedded content within the transcripts.\n
Capability inventory: The bot script bot.js (as described in SKILL.md) has the capability to execute financial trades on multiple exchanges and write logs to the local file system (trades.csv).\n
Sanitization: Absent. There is no evidence of sanitization or validation of the extracted transcript content before it is used to generate trading logic.\n- [PERSISTENCE]: The deployment instructions involve configuring a crontab entry on a VPS to maintain the bot's operation across reboots and scheduled intervals.\n- [PRIVILEGE_ESCALATION]: The VPS setup guide instructs the user to access the server as the root user and use apt to install system-level packages.\n- [COMMAND_EXECUTION]: The workflow involves multiple shell commands for cloning, configuring, and running the application, including git clone, npm install, and direct node execution.

claude-tradingview-mcp-autotrading