The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/discover.py engine can fetch the strategy catalog from the vendor's GitHub repository (github.com/Senpi-ai) if a local copy is not present. This is a standard update mechanism for the skill's data and targets the author's own infrastructure.
[COMMAND_EXECUTION]: The test suite (tests/test_cli.py) utilizes subprocess.run to execute the discovery script for integration testing. This activity is confined to the development and testing phase and does not occur during normal agent operations.
[DYNAMIC_EXECUTION]: The scripts/discover.py script uses a dynamic import (__import__) for the standard tempfile module to resolve the system's temporary directory. This is a benign implementation detail.
[DATA_EXFILTRATION]: The skill interacts with the vendor's MCP server (mcp.prod.senpi.ai) to retrieve market data and account portfolio information using the SENPI_AUTH_TOKEN. All communications are directed to the authenticated vendor infrastructure required for the skill's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill ingests strategy metadata and external market/account data. While this represents an attack surface, the ingestion is highly structured via a local engine, and the agent is provided with clear boundaries to rank and narrate rather than execute the data.

senpi-strategy-discover