The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell commands (curl) to interact with blockchain RPC endpoints and external market data APIs. It employs variable interpolation for contract addresses and RPC URLs sourced from local configuration files.
[EXTERNAL_DOWNLOADS]: The skill fetches real-time market data, stablecoin statistics, and sentiment indicators from reputable crypto-financial services including DeFiLlama, CoinGecko, alternative.me, and Polymarket. These are well-known industry sources and the data is used for informational summaries.
[CREDENTIALS_SAFE]: The skill manages an optional CoinGecko API key and custom RPC URLs. It correctly uses environment variable placeholders (e.g., {COINGECKO_API_KEY}) and specific tools (./secretcurl) designed to prevent sensitive credentials from appearing in logs or command history.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from web searches and external API responses. It implements a strong security boundary by explicitly instructing the agent to treat all fetched fields as untrusted, and strictly forbidding the interpolation of this data into shell commands or following instructions embedded within the retrieved content.
[DATA_EXPOSURE]: The skill reads and writes to local memory files (memory/logs/, memory/topics/market-context.md) to maintain state and historical context. The data handled (market prices, TVL, yields) is non-sensitive market information. Position monitoring is restricted to addresses provided by the user in on-chain-watches.yml.
[REMOTE_CODE_EXECUTION]: No patterns of downloading and executing remote scripts or arbitrary code were detected. All external interactions are limited to data retrieval via standard APIs.

defi-overview