The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill autonomously fetches company metadata, including business overviews and investment theses, from the Financial Modeling Prep (FMP) API. This information is interpolated into the agent's context via JSON artifacts and candidate packets. An attacker who could compromise or influence the data at the source provider could theoretically embed malicious instructions designed to bias the agent's stock recommendations or analysis.
Ingestion points: Data from the external API enters the agent's context through run-summary.json and files in the candidate-packets/ directory.
Boundary markers: The instructions do not currently include explicit delimiters or 'ignore embedded instruction' warnings for the fetched API data.
Capability inventory: The agent has the capability to execute local Python scripts that can perform network requests and filesystem writes.
Sanitization: While the skill performs extensive numeric validation, it does not explicitly sanitize free-text fields like business descriptions before presenting them to the agent.
[EXTERNAL_DOWNLOADS]: The skill connects to financialmodelingprep.com to retrieve market data and analyst estimates. This is the core purpose of the skill and uses an established financial data service.
[COMMAND_EXECUTION]: Test scripts (e.g., scripts/tests/test_evaluate_candidates.py) utilize subprocess.run to execute the tool's own CLI commands for validation. This is standard testing practice and does not involve executing unsanitized user input.

us-undervalued-growth-screener