The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation process involves downloading component files from the vendor's official GitHub repository (github.com/Senpi-ai/senpi-skills). These resources are vendor-owned and part of the expected setup workflow.
[COMMAND_EXECUTION]: The skill instructions include standard shell commands for setting up a workspace and running a background daemon. The use of nohup and disown is a common practice for maintaining long-running processes on a server.
[DATA_EXFILTRATION]: The skill requires the SENPI_AUTH_TOKEN environment variable to authenticate with the platform's API and MCP tools. This sensitive credential is used strictly for the intended trading functionality and is not transmitted to unauthorized external domains.
[PROMPT_INJECTION]: The skill ingests external position data from the trading leaderboard. Potential risks of indirect prompt injection are mitigated by the LLM gate's strict output rules, which mandate exact copying of signal parameters and provide clear boundary markers for the data block.
[REMOTE_CODE_EXECUTION]: While the skill downloads scripts from GitHub, there is no evidence of arbitrary code execution or piping remote content directly into a shell. The scripts are local files executed by the user as part of the strategy deployment.

remora-strategy