The Agent Skills Directory

[SAFE]: The skill serves as an instructional manual for financial report decomposition and analysis (A-shares, Hong Kong, and US stocks). It defines standard procedures for calculating TTM (Trailing Twelve Months), quarterly adjustments, and financial ratios using established data sources.
[INDIRECT_PROMPT_INJECTION]: The skill identifies an attack surface by ingesting data from external financial APIs such as Sina Finance, Yahoo Finance, and Eastmoney. However, this is inherent to the skill's purpose and the risk is assessed as safe given the lack of dangerous capabilities.
Ingestion points: Data enters the agent context through tools like fetch_financials, sina_income_statement, yahoo_financials, and fetch_announcements in SKILL.md.
Boundary markers: The instructions do not specify the use of delimiters (e.g., XML tags or triple quotes) to isolate ingested data from the system prompt.
Capability inventory: The skill utilizes data fetching and mathematical calculation tools (calc). It does not include subprocess execution, arbitrary file writes (writes are restricted to a calcs/ directory via a managed CLI tool), or unauthorized network operations.
Sanitization: There is no evidence of explicit sanitization or validation of the external financial data before it is processed by the agent.

earnings-analysis