The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/get_data.py contains a hardcoded credential (em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg) assigned to the EM_API_KEY variable as a default value. This exposes the service key within the source code.
[DATA_EXFILTRATION]: The skill performs network requests to the East Money financial data service (ai-saas.eastmoney.com) to retrieve company information. While this is necessary for its functionality, it involves outbound traffic to a third-party domain.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its processing of external data.
Ingestion points: Data enters the agent's context from the ai-saas.eastmoney.com API response via scripts/get_data.py.
Boundary markers: No explicit delimiters or instructions are used to separate the external data from the agent's core instructions.
Capability inventory: The skill uses the openpyxl library in scripts/excel_theme.py to write data to Excel files and instructions in SKILL.md prompt the agent to read and analyze these files.
Sanitization: There is no evidence of filtering or sanitizing the strings returned by the API before they are presented to the agent for analysis.

comparable-company-analysis