The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes trade data from external CSV files and interpolates the content directly into Markdown reports. If the CSV content (such as symbol names or trade descriptions) contains malicious Markdown or HTML, it could influence the rendered output.
Ingestion points: read_csv_files(input_dir) in scripts/consolidate.py reads data from user-specified directories.
Boundary markers: None detected; instructions do not advise the agent to ignore embedded commands in the source data.
Capability inventory: The script has capabilities to write files to the filesystem (generate_markdown, generate_csv) and perform local network port probing (fetch_unrealized_pnl).
Sanitization: No sanitization is applied to trade fields (UnderlyingSymbol, Strike, etc.) before they are inserted into Markdown tables.
[EXTERNAL_DOWNLOADS]: The skill requires the trading-skills dependency, which is not a standard library and whose source/security posture is not defined within the skill files.
[COMMAND_EXECUTION]: The skill uses uv run to execute a Python script that performs file system operations and probes local network ports (7496/7497) to connect to Interactive Brokers software.

ib-create-consolidated-report