The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches data from external, untrusted web sources such as news sites and search results. This presents a surface for indirect prompt injection. The skill mitigates this risk by using a sanitization module (sources/textsafe.py) that normalizes the text and replaces action-oriented financial keywords (e.g., 'Buy', 'Target Price') with neutral markers before the data enters the agent's context.
[DYNAMIC_EXECUTION]: The scripts/fetch_endpoint.py script dynamically loads source modules and mappers using importlib.import_module() based on a static configuration file (datasources/registry.json). This allows for extensible data source handling while remaining within a defined set of skill-internal modules.
[COMMAND_EXECUTION]: Several test files (scripts/tests/test_eastmoney.py, scripts/tests/test_registry_sources.py, etc.) utilize the subprocess module to run local scripts and CLI commands during automated unit testing. These executions are confined to the testing environment and are not present in the runtime data-access scripts.
[EXTERNAL_DOWNLOADS]: The skill downloads financial information and web content from multiple public endpoints. It includes a dedicated module (scripts/core/cdp.py) for managing a local browser channel via the Chrome DevTools Protocol, which incorporates security checks to prevent SSRF and restrict access to local or internal network resources.

data-access