The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes GitHub usernames (handles) and interpolates them directly into a natural language prompt sent to the Bankr Agent API (e.g., {"prompt":"What is the EVM address linked to ${HANDLE} on Base?..."}). This creates an attack surface where a contributor could use a malicious GitHub username to inject instructions into the address resolution process, potentially misdirecting payments.
Ingestion points: GitHub usernames are fetched via the gh api search/issues command (SKILL.md, Phase A2).
Boundary markers: The handle is interpolated directly into the JSON prompt string without delimiters or instructions for the agent to ignore embedded commands (SKILL.md, Phase B3).
Capability inventory: The skill has onchain_writes and external_api capabilities, performing token transfers via the /wallet/transfer API (SKILL.md, Phase B4).
Sanitization: There is no evidence of handle sanitization or validation before interpolation into the prompt.
[DYNAMIC_EXECUTION]: The skill uses python -c to execute generated Python snippets for updating the memory/distributions.yml file. This pattern involves runtime assembly and execution of code strings to handle file I/O and YAML processing (SKILL.md, Phase A6).
[DATA_EXPOSURE_AND_EXFILTRATION]: The skill transmits recipient handles and resolved wallet addresses to the external Bankr API (api.bankr.bot). While this is central to the skill's functionality, it involves sending project contributor data to a third-party service provider (SKILL.md, Phase B2, B3, B4).

distribute-tokens