The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches blockchain data, including verified source code and token metrics, from Etherscan v2 and Base RPC services. These are established, well-known infrastructure providers in the cryptocurrency ecosystem.
[COMMAND_EXECUTION]: Executes shell commands via curl, jq, and a custom script ./secretcurl. The use of ./secretcurl allows for secure handling of the ETHERSCAN_API_KEY by using internal placeholders, ensuring the secret never appears in the shell history or command-line logs.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content, such as smart contract source code and metadata, which creates a surface for indirect prompt injection.
Ingestion points: Data is ingested from the Etherscan API (api.etherscan.io), Base RPC endpoints (mainnet.base.org), and local log files in the memory/ directory.
Boundary markers: The skill contains explicit instructions to treat all fetched addresses, source code, and strings as untrusted data.
Capability inventory: Capabilities include network read operations and data parsing using standard CLI tools within the SKILL.md instructions.
Sanitization: The skill implements validation for subject addresses (ensuring they follow the 0x + 40 hex character format) and instructs the agent to ignore any instructions found within the downloaded content.

investigation-report