The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs the installation of a global NPM package @ricequant2026/rqams-cli. This package name is suspicious because it appends a year suffix to the author name 'ricequant', a pattern often used in typosquatting or impersonation attempts. This is inconsistent with the vendor's official domain ricequant.com and the Python package name rqamsc used elsewhere in the skill.
[COMMAND_EXECUTION]: The skill executes global installation commands for untrusted or suspicious packages.
Evidence: npm install -g @ricequant2026/rqams-cli in SKILL.md and rqams-cli/SKILL.md. Global installation of a potentially impersonated package poses a high risk to the local system.
[PROMPT_INJECTION]: The skill processes external financial data such as valuation reports, trade flows, and custodian events, creating an indirect prompt injection surface.
Ingestion points: Data is ingested through rqamsc-cli outputs and imported files described in references/ams_valuation_flow.md (e.g., trade logs, position statements).
Boundary markers: The skill does not define delimiters or isolation instructions to prevent the agent from obeying instructions embedded within the financial data.
Capability inventory: The agent can execute shell commands via rqamsc, perform file system operations (write/delete), and make network API requests.
Sanitization: No evidence of data sanitization or validation for the content of processed reports is present in the scripts or instructions.

rqams