The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file scripts/common.py contains a hardcoded API key (em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg) as a default value for the EM_API_KEY environment variable. This secret is used to authenticate requests to the EastMoney API.
[DATA_EXFILTRATION]: The skill performs network operations to ai-saas.eastmoney.com, a well-known financial service domain, to fetch stock entities, report periods, and earnings reviews. User queries and internal identifiers are transmitted to this external service.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the processing of untrusted user input.
Ingestion points: User-provided queries passed via the --query argument to scripts/validate_entity.py.
Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present when interpolating the user query into API payloads.
Capability inventory: The skill has the capability to perform network POST requests (via httpx in scripts/validate_entity.py and scripts/call_review_api.py) and write binary data (PDF/Word/Excel) to the local file system (via Path.write_bytes in scripts/call_review_api.py).
Sanitization: The skill cleans header values but does not perform sanitization, escaping, or validation on the user query content before it is used in external service requests.

stock-earnings-review