The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill accesses sensitive wallet data stored in ~/.aibtc/wallets.json and individual keystore files within ~/.aibtc/wallets/. It decrypts mnemonics to derive private keys for signing transactions. While this is the intended functionality for a trading agent, it involves high-sensitivity credential handling.
[COMMAND_EXECUTION]: The install-packs command utilizes child_process.execSync to run bun add for various dependencies. This allows the skill to execute shell commands and modify the local environment by installing external Node.js packages.
[DYNAMIC_EXECUTION]: The script dynamically loads the @bitflowlabs/core-sdk and various @stacks libraries at runtime using dynamic imports and require, which facilitates execution of code installed through the install-packs command.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the Bitflow and Hiro APIs which is used to drive agent decision-making for trade execution.
Ingestion points: External data is fetched from https://bff.bitflowapis.finance (pool and active bin price data) and https://api.mainnet.hiro.so (account and token balances) in bitflow-limit-order.ts.
Boundary markers: None present; the parsed JSON data from these APIs is directly compared against price targets to trigger actions.
Capability inventory: The skill can execute shell commands, read/write local files (orders, events, and keystores), and broadcast blockchain transactions.
Sanitization: The script uses Number() and BigInt() to parse API values, providing basic type-level validation for numeric price and balance data.

bitflow-limit-order