The Agent Skills Directory

[SAFE]: The skill uses local scripts (scripts/research.py and scripts/mcp_client.py) that rely exclusively on the Python standard library. The engine's logic is transparent and focused on data analysis and ranking of trader track records.
[COMMAND_EXECUTION]: The agent is instructed to execute specific Python scripts provided within the skill. These executions are scoped to the skill's local directory and do not involve dynamic command generation or execution of arbitrary code from untrusted sources.
[DATA_EXFILTRATION]: Network communication is directed exclusively to https://mcp.prod.senpi.ai/mcp, which is an official endpoint for the vendor (senpi-ai). The required SENPI_AUTH_TOKEN is passed via environment variables, following standard security practices for API access.
[INDIRECT_PROMPT_INJECTION]: While the skill processes external data from trader records, it incorporates robust instructions for the agent to only use specific JSON fields and resolve addresses accurately. These rules act as a safeguard against potential injection attempts embedded in trader data.

senpi-trader-research