The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/full_function_smoke_check.py executes shell commands using subprocess.run(cmd, shell=True). The command string is constructed by directly interpolating user-controllable arguments such as --us-symbol and --hk-symbol. This allows for arbitrary command execution if an attacker provides stock symbols containing shell metacharacters (e.g., ;, &, |).
[EXTERNAL_DOWNLOADS]: The skill performs network requests to several external financial data sources and stock exchanges.
Evidence: The implementation fetches data from well-known and reputable services including Tencent (gtimg.cn), Sina (sinajs.cn), Yahoo Finance (yahoo.com), the Federal Reserve Economic Data service (stlouisfed.org), Nasdaq (nasdaqtrader.com), and the Hong Kong Stock Exchange (hkex.com.hk).

market-data