The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/get_data.py contains a hardcoded API key (em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg) used as a default value for the EM_API_KEY environment variable. Hardcoding credentials in source code is a security risk as it can lead to unauthorized access if the key is leaked or reused.
[EXTERNAL_DOWNLOADS]: The skill connects to the Eastmoney official API (ai-saas.eastmoney.com) to retrieve structured financial data. This is a well-known financial information service provider.
[COMMAND_EXECUTION]: The skill's instructions and 'Quick Start' section guide the user to execute the scripts/get_data.py script via the command line using python3, which involves local command execution for data processing.
[DATA_EXFILTRATION]: The skill transmits user-supplied natural language queries to an external third-party domain (ai-saas.eastmoney.com). While required for the skill's primary function of data retrieval, this pattern involves sending user intent and potentially sensitive financial interest data outside the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its ingestion of external data.
Ingestion points: User-provided search queries are ingested via command-line arguments in scripts/get_data.py and subsequently sent to an external API.
Boundary markers: None identified; the query is concatenated directly into the JSON request body.
Capability inventory: The skill has the ability to perform network requests (httpx) and write files to the local file system (pandas, openpyxl).
Sanitization: There is no evidence of input validation or sanitization on the user query before processing or transmission.

mx-finance-data