The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file scripts/_stock_utils.py contains a hardcoded phone number (+17327595647) assigned to DEFAULT_PHONE.
[PERSISTENCE]: The file references/launchd-setup.md provides detailed instructions and a configuration template for creating a macOS launchd agent (com.claude.stock-monitor.plist) to run the stock monitor in the background every 30 minutes.
[COMMAND_EXECUTION]: The send_notification function in scripts/_stock_utils.py uses subprocess.run to execute external Python scripts located at ~/.claude/skills/sms/scripts/sms_send.py and ~/.claude/skills/slack/scripts/slack_post.py for notification dispatch.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted product titles and variant names fetched from external Shopify store APIs and includes them in notifications.
Ingestion points: Product JSON is fetched from Shopify URLs in scripts/_stock_utils.py via the fetch_shopify_js function.
Boundary markers: Absent. External product titles are interpolated directly into notification messages.
Capability inventory: Uses subprocess.run for notifications and sqlite3 for local database logging.
Sanitization: No sanitization or escaping of the fetched product titles is performed before they are used in terminal output or passed to notification scripts.

stock-monitor