The Agent Skills Directory

[SAFE]: The skill functions as a non-executable router. Its primary purpose is to provide users with information and setup paths for other skills in the repository based on their stated investment goals. It does not perform trades, auto-run other skills, or modify the system state.
[COMMAND_EXECUTION]: The skill invokes a local script, recommend.py, to process user input. Analysis of the script confirms it is safe, relying on argparse for input handling and pathlib for local file access. It does not execute arbitrary shell commands or user-supplied strings.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user queries into its recommender engine. This surface is handled securely through deterministic string matching against a static set of trigger terms. Malicious or irrelevant inputs (e.g., prompt injection attempts) are correctly handled by falling back to a safe beginner on-ramp rather than obeying injected instructions.
[EXTERNAL_DOWNLOADS]: While the skill's metadata describes various trading API integrations (such as Alpaca, FMP, and Finviz), the Navigator skill itself does not initiate any network connections. It provides educational guidance on these requirements and correctly instructs users to manage their own API keys via environment variables.
[DYNAMIC_EXECUTION]: The Python scripts utilize standard library imports and yaml.safe_load for parsing local configuration files. No unsafe dynamic code execution patterns like eval() or exec() are used on untrusted data.

trading-skills-navigator