The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: Automated security scanners have confirmed the presence of ten malicious URLs within the skill's reference files. These include confirmed phishing sites such as 'https://ptah.trade' and 'https://bibiai.fun'. The file 'references/agcid-cases.json' is specifically flagged as 'FileRepMalware', representing a confirmed detection of a malicious component within the skill package.
[REMOTE_CODE_EXECUTION]: The skill's documentation and case studies (e.g., in 'references/agcid-cases.json' and 'references/ecosystem-cases.json') provide instructions for the agent to execute shell commands and install packages from remote sources, such as 'npx skills add...' and '@binance/agentic-wallet'. Execution of these commands from unverified or malicious sources leads directly to remote code execution on the host machine.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill is designed to fetch, process, and 'research' data from unverified URLs, social media posts, and external contracts (as described in 'references/contract-research.md' and 'SKILL.md').
Boundary markers: While the instructions suggest that external posts do not constitute authorization, there are no effective programmatic boundaries to prevent malicious instructions embedded in web content from hijacking the agent's logical flow.
Capability inventory: The skill possesses high-impact capabilities including cross-account wallet management, token approval (allowance), and transaction execution (minting/selling) via the Binance Agentic Wallet CLI.
Sanitization: The system lacks rigorous input sanitization, relying on AI interpretation to extract 'recipes' and 'logic' from potentially adversarial external content.
[DATA_EXFILTRATION]: The skill manages sensitive local configuration files (e.g., '~/.agent-wallet-desk/local-config.json'). Its design, which combines local web services with unverified external research data and wallet CLI interactions, creates a significant risk of sensitive session data, configuration, or transaction metadata being leaked to malicious third-party domains identified in the research modules.
[COMMAND_EXECUTION]: The skill orchestrates multiple local Python scripts and CLI tools (such as 'tools/check.py', 'mint_flow.py', and 'baw'). This complex execution environment is vulnerable to command injection if an attacker-controlled contract name or 'researched' parameter is interpolated into a shell execution context.

agent-wallet-desk