The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes external financial data, creating a surface for indirect prompt injection. \n
Ingestion points: Data is fetched from an external API endpoint (221.204.19.233:7172) using scripts such as scripts/stock_data_demo.py, scripts/fund_data_demo.py, and others. \n
Boundary markers: Analysis indicates an absence of explicit delimiters or instructions directing the agent to ignore commands potentially embedded in fetched fields (e.g., company descriptions or news). \n
Capability inventory: The skill possesses network access (requests), file system write access for data export (CSV/Parquet), and the ability to execute local Python scripts. \n
Sanitization: Content retrieved from the API is interpolated into the agent's context without explicit sanitization or validation of embedded instructions. \n- [COMMAND_EXECUTION]: The skill's workflow requires the execution of Python scripts (python scripts/check_env.py) to manage its operating state, verify configuration, and fetch data. \n- [DYNAMIC_EXECUTION]: The script scripts/check_env.py performs environment discovery using importlib.import_module and importlib.util.find_spec. These calls are used to verify the installation of the sxsc_tushare SDK and use hardcoded targets, mitigating the risk of arbitrary code loading.

shanxi-securities-tushare