The Agent Skills Directory

[PERSISTENCE]: The skill instructions direct the agent to store sensitive API tokens within persistent shell configuration files.
Evidence: In references/auth.md, the instructions state: "Store token where this agent reads its environment: the shell profile, a git-ignored .env, or the agent's own secret store."
Risk: Modifying shell profiles (e.g., ~/.bashrc, ~/.zshrc) is a persistence mechanism that can be leveraged to execute code in future sessions.
[INDIRECT_PROMPT_INJECTION]: The skill processes financial news and market events from external sources, which could be used to deliver malicious natural language instructions to the agent.
Ingestion points: Fetches data via GET /v1/news (references/news.md), GET /v1/pulse/events (references/data.md), and GET /v1/sectors/{sector}/events (references/sectors.md).
Boundary markers: The skill does not provide clear instructions or delimiters to ensure the agent treats external content strictly as data rather than instructions.
Capability inventory: The agent has the capability to perform paper trading actions (POST /v1/autopilots/{id}/actions) and update environment files based on the ingested information.
Sanitization: No sanitization or filtering logic is specified for the high-volume news and event data processed by the agent.

simianx