The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches smart contract information, source code, and transaction history from well-known and trusted services including Etherscan and official Base RPC nodes.
[COMMAND_EXECUTION]: Employs standard system utilities like curl and jq to perform network requests and parse blockchain data. Subject addresses are validated against hex-encoded address formats to prevent command injection.
[CREDENTIALS_UNSAFE]: While the skill utilizes API keys for Etherscan, it employs a secure wrapper (./secretcurl) that uses placeholders to prevent secrets from appearing in process lists or shell history. It also correctly advises users to manage secrets via environment configuration.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external smart contract source code. However, it includes robust defensive instructions that explicitly command the agent to treat all fetched content as data and ignore any embedded instructions or prompts found within contract comments or metadata.
[SAFE]: The overall architecture adheres to the principle of least privilege, operating in a read-only mode and providing clear boundaries for the agent's behavior when processing external information.

investigation-report