The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The script scripts/get_data.py contains a hardcoded API key assigned as a default value to the EM_API_KEY variable: "em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg". This key is used for authentication in the em_api_key header when making requests to the Eastmoney service. Hardcoding credentials in source code is a high-risk practice as it can lead to credential leakage if the code is shared or exposed.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes data from an external API and presents it to the agent without proper sanitization or boundary markers.
Ingestion points: Data is fetched from the Eastmoney API in scripts/get_data.py via the _http_call_search_news function which is called within query_financial_news.
Boundary markers: The skill does not implement delimiters or specific instructions to the agent to ignore embedded commands when processing the retrieved financial information.
Capability inventory: The skill has the capability to write files to the local filesystem using output_path.write_text(content, encoding="utf-8") in scripts/get_data.py.
Sanitization: There is no evidence of validation, escaping, or filtering of the content retrieved from the external API before it is processed or saved to disk.

mx-finance-search