The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/daily_sector_trends.py fetches data from onetotenvip.com but explicitly disables SSL/TLS certificate verification (ssl.CERT_NONE) and hostname validation. This insecure implementation exposes the skill to man-in-the-middle (MitM) attacks, allowing potential attackers to intercept or modify the article data being retrieved.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes article titles and summaries from a third-party API.
Ingestion points: Data returned by the remote API at onetotenvip.com and processed in scripts/daily_sector_trends.py.
Boundary markers: None; the agent is not instructed to ignore or treat the article content as potentially untrusted instructions.
Capability inventory: The skill has the ability to write files (data.json and report.html) to the local file system.
Sanitization: While basic HTML escaping is applied to the report, the agent's textual analysis processes the raw strings directly.
[DATA_EXFILTRATION]: User-specified keywords and sector names are transmitted to the external domain onetotenvip.com. If users inadvertently include sensitive information in their queries, that data will be exposed to the external service.

baokuan-article-analysis