The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves contributor handles from the GitHub API and interpolates them into a natural language prompt sent to the Bankr Agent API (e.g., 'What is the EVM address linked to ${HANDLE} on Base?'). A malicious contributor could potentially use a specially crafted GitHub username to attempt to influence the resolution process.
Ingestion points: Contributor logins fetched from GitHub's search/issues API.
Boundary markers: No explicit delimiters are used around the interpolated handle in the prompt.
Capability inventory: The skill possesses high-privilege capabilities including onchain_writes and external_api access.
Sanitization: The skill uses a regular expression (0x[a-fA-F0-9]{40}) to extract the resulting address, which mitigates the risk of executing a transfer to a non-address string.
[COMMAND_EXECUTION]: The skill relies on standard command-line tools for its operations, including gh for GitHub interactions, git for repository configuration, and utilities like jq, sed, and python for data parsing and YAML manipulation.
[EXTERNAL_DOWNLOADS]: The skill interacts with two external services: the GitHub API for project data and the Bankr API for wallet services and handle resolution. These interactions are core to the skill's stated purpose.

distribute-tokens