The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/utils/md_to_html.py executes a shell command using os.popen('date') to generate a timestamp for inclusion in report footers. While the command is hardcoded, the use of shell invocation for simple metadata is a risky pattern.
[DYNAMIC_EXECUTION]: The prediction and training modules (scripts/utils/predictor/evaluation.py and scripts/utils/predictor/training.py) contain eval() calls as identified by static analysis. Furthermore, these modules use torch.load() to import machine learning model weights. If the model files are sourced from an untrusted location or tampered with, this can lead to arbitrary code execution.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple external sources, creating an attack surface where malicious instructions could be embedded in market news or search results to influence the agent's behavior.
Ingestion points: Untrusted content is fetched via the Jina Reader API in scripts/utils/content_extractor.py, the NewsNow API in scripts/utils/news_tools.py, and web search results in scripts/utils/search_tools.py.
Boundary markers: The skill uses explicit delimiters in its prompts (e.g., === Baseline Signal ===, === Latest Tracking === in references/PROMPTS.md) to separate untrusted context from core instructions.
Capability inventory: The skill is capable of writing to a SQLite database (DatabaseManager), generating HTML reports on the local filesystem (scripts/utils/md_to_html.py), and performing diverse network operations.
Sanitization: FinUtils.sanitize_signal_output (scripts/fin_agent.py) includes a validation step that checks extracted stock tickers against a local database of known companies to reduce the risk of halluncinated or malicious entity binding.
[EXTERNAL_DOWNLOADS]: The skill fetches financial data and market news from several external providers, including newsnow.busiyi.world, gamma-api.polymarket.com, and the akshare library. It also retrieves content from web pages using the Jina Reader service (r.jina.ai).

alphaear-signal-tracker