The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell_exec to run curl commands for interacting with the Alpaca Trading API and various financial data providers like Yahoo Finance and Google Finance. These operations are essential to its function as a trading tool and target well-known, legitimate services.\n- [DYNAMIC_EXECUTION]: The instructions direct the agent to generate and execute small Python scripts using python3 -c for parsing JSON API responses and calculating technical indicators like RSI. The Python code logic is provided as static templates within the skill's instructions, representing a low-risk use of dynamic execution for data processing.\n- [INDIRECT_PROMPT_INJECTION]: By design, the skill ingests and analyzes untrusted third-party data from the web, including news headlines, social media sentiment (Reddit/Twitter), and analyst reports. This creates a surface for indirect prompt injection where external content could attempt to influence trading decisions, a risk factor managed by the LLM's own filters and the skill's requirement for multi-factor signal fusion.\n- [CREDENTIALS_UNSAFE]: The skill manages sensitive Alpaca API credentials. It adheres to security standards by utilizing platform-provided environment variable mapping (ALPACA_API_KEY, ALPACA_SECRET_KEY) in the configuration metadata rather than hardcoding secrets directly in the prompt or scripts.

trader-hand-skill