The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The instructions in references/data-queries.md direct the agent to execute a Python script (views_runner.py) located in an external directory (../findata-toolkit-cn/scripts/) which is not included within the skill package itself.
[EXTERNAL_DOWNLOADS]: The skill requires the agent to install third-party dependencies using pip install -r ../findata-toolkit-cn/requirements.txt. This process downloads and installs external packages from public registries, which can introduce supply chain risks if the requirements are unverified.
[COMMAND_EXECUTION]: The operational workflow requires the agent to execute shell commands to activate virtual environments (source ../../.venv/bin/activate) and run data retrieval tools.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external financial APIs and web sources (e.g., Eastern Fortune, Tonghuashun).
Ingestion points: Data returned by the views_runner.py script from various financial data providers in JSON format.
Boundary markers: No specific delimiters or "ignore instructions" markers are defined to isolate external data from the agent's core instructions.
Capability inventory: The skill possesses the capability to execute Python scripts, run shell commands, and access environment variables.
Sanitization: The instructions do not define any sanitization, filtering, or validation logic for the external data ingested before it is processed by the analysis framework.
[DYNAMIC_EXECUTION]: The skill instructs the agent to dynamically construct and execute command-line strings for data querying, passing user-supplied parameters (like symbols and dates) into the execution environment.

fund-flow-monitor