The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses the commander library to define and handle CLI commands (doctor, run, simulate, batch). These commands are intended for the agent to interface with the simulation logic through standard shell execution.
[EXTERNAL_DOWNLOADS]: The skill communicates with the external endpoint api.stxer.xyz using the fetch API. These requests are used to create simulation sessions and evaluate Clarity expressions. This network activity is central to the skill's documented purpose of providing contract pre-flight checks.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of Clarity expressions and batch step JSON objects provided via CLI arguments. While this creates a potential attack surface for indirect prompt injection, the skill implements several guardrails:
Ingestion points: The --expression and --steps arguments in the simulate and batch commands within contract-preflight.ts.
Boundary markers: The skill relies on its internal logic and description in SKILL.md to define expected inputs, though it lacks explicit natural language boundary markers (like 'ignore previous instructions') in the simulation payload.
Capability inventory: The skill's capabilities are limited to making network requests to a specific third-party simulation API (api.stxer.xyz) and decoding the results locally. It does not perform local file writes, shell command generation from input, or arbitrary code evaluation.
Sanitization: The script enforces strict safety limits, including a MAX_EXPRESSION_LENGTH of 2,000 characters and a MAX_STEPS_PER_SESSION of 20 to prevent resource abuse and runaway simulations.

contract-preflight