The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes local notification scripts (e.g., sms_send.py, slack_post.py) using subprocess.run. These calls use list-based arguments, which is a secure practice that prevents shell injection.
[EXTERNAL_DOWNLOADS]: Fetches product metadata and availability status from external Shopify store URLs via standard HTTP requests.
[PERSISTENCE]: Provides documentation and a template for setting up a persistent background monitor on macOS using launchd. This allows monitoring to continue outside of the agent session.
[DATA_EXFILTRATION]: Transmits product availability and pricing information to external notification channels (SMS and Slack) as part of its core alerting functionality.
[INDIRECT_PROMPT_INJECTION]: The skill processes JSON data from third-party Shopify stores, which represents a potential surface for indirect injection if malicious product titles are used to influence downstream logic.
Ingestion points: The fetch_shopify_js function in scripts/_stock_utils.py retrieves data from Shopify domains.
Boundary markers: The data is parsed structurally as JSON; however, there are no specific markers instructing the agent to ignore instructions embedded in product metadata.
Capability inventory: The skill has the ability to execute subprocesses (notification scripts) and write to a local SQLite database.
Sanitization: The skill extracts specific keys (e.g., available, price, title) and performs basic type validation.

stock-monitor