The Agent Skills Directory

[PROMPT_INJECTION]: The skill processes external data from the Alpaca API, which constitutes an indirect prompt injection surface. The risk is mitigated by the use of structured data and strict Zod schema validation for all tool inputs and outputs.
[COMMAND_EXECUTION]: The connector's CLI entry point uses spawnSync to run internal logic. This is a standard and safe architectural pattern for Node.js tools, restricted to executing locally bundled script files.
[SAFE]: The skill includes a dedicated safety boundary that prevents financial transactions on live accounts unless the user has provided explicit, double-gated consent via environment configuration.
[SAFE]: Authentication is handled securely through environment variables or Zapier-managed connections, with no hardcoded credentials or unauthorized data exfiltration paths detected.

alpaca