The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches stock market data and metadata from the Financial Modeling Prep (FMP) API via scripts/analyze_downtrends.py. This external content is interpolated directly into Markdown reports without sanitization or explicit boundary markers. This creates an attack surface where malicious instructions returned by the API could potentially influence the agent's behavior when it later processes the generated reports.\n
Ingestion points: The fetch_stock_list and fetch_historical_prices functions in scripts/analyze_downtrends.py ingest data from financialmodelingprep.com.\n
Boundary markers: None are used when interpolating API data into reports or the analysis JSON.\n
Capability inventory: The skill has file-write access to the local reports/ directory and performs network requests to external APIs.\n
Sanitization: There is no escaping or filtering of external strings (such as sector names or symbols) before they are written into output files.- [DYNAMIC_EXECUTION]: The script scripts/generate_histogram_html.py generates an HTML file that includes JavaScript and embeds data fetched from the FMP API. This data is injected into the HTML structure using string formatting and JSON stringification without proper HTML entity encoding, creating a stored Cross-Site Scripting (XSS) surface in the tool's output.- [EXTERNAL_DOWNLOADS]: The skill fetches financial data from financialmodelingprep.com and the generated HTML report loads the Plotly.js library from https://cdn.plot.ly/plotly-2.27.0.min.js. Both are well-known services and are documented here for transparency.

downtrend-duration-analyzer