The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npm install --ignore-scripts neural-trader to ensure the presence of an external dependency from the public npm registry. The use of the --ignore-scripts flag is a standard security practice to prevent malicious post-installation scripts from running, but the package content itself is downloaded from an external source at runtime.
[COMMAND_EXECUTION]: The skill executes shell commands via npx neural-trader to perform detection and generate technical indicators. This results in the execution of external code from the downloaded package within the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data such as ticker symbols and technical indicator values (e.g., RSI, ADX) which are passed into the ruflo__neural_predict tool and search queries. This represents an attack surface where malicious data could attempt to influence the agent's decision-making process, although the skill does not expose high-privileged capabilities like credential access or network exfiltration for this data to exploit.

trader-regime