The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file scripts/get_data.py contains a hardcoded API key assigned to the EM_API_KEY variable, which is used for authentication with the East Money API.
[EXTERNAL_DOWNLOADS]: The skill fetches data from https://ai-saas.eastmoney.com/proxy/app-robo-advisor-api/assistant/hotspot-discovery. East Money is a well-known financial information service provider.
[DATA_EXFILTRATION]: The script scripts/get_data.py receives data from a remote API and writes it to the local file system at {cwd}/miaoxiang/stock_market_hotspot_discovery/.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it ingests data from an external third-party API and processes it without sanitization.
Ingestion points: External data enters the system through the _http_call_hotspot_discovery function in scripts/get_data.py which calls the East Money API.
Boundary markers: The skill does not implement delimiters or 'ignore' instructions to isolate the untrusted API response from the agent's logic.
Capability inventory: The script performs file system writes (pathlib.Path.write_text) and network operations via urllib.
Sanitization: There is no evidence of sanitization, filtering, or validation of the content received from the API before it is written to files or displayed.

stock-market-hotspot-discovery