The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests market and position data from external Bitflow and Hiro APIs to drive its liquidity management logic. While this data is structured JSON and processed numerically, it represents a surface where compromised external data could theoretically influence the agent's actions (e.g., triggering unnecessary re-centers).
Ingestion points: fetchAllPools, fetchPoolBins, and fetchUserPositions in hodlmm-range-keeper.ts retrieve data from Bitflow and Hiro API endpoints.
Boundary markers: The skill does not implement specific boundary markers or instructions to the LLM to ignore embedded content within the fetched JSON payloads.
Capability inventory: The skill triggers sensitive financial operations via the bitflow_hodlmm_remove_liquidity and bitflow_hodlmm_add_liquidity MCP tools.
Sanitization: The script performs type conversion (BigInt/Number) and logic validation (drift thresholds, gas limits) on the ingested data, which mitigates the risk of direct command injection but leaves the logic vulnerable to data manipulation at the source.
[EXTERNAL_DOWNLOADS]: The skill performs network requests to bff.bitflowapis.finance and api.hiro.so. These are well-known infrastructure and API providers for the Stacks (STX) blockchain ecosystem and are used here for legitimate market data and balance queries.
[COMMAND_EXECUTION]: The skill implements a comprehensive CLI using the commander library to handle various stages of position management. It outputs instructions for the agent to execute specific shell commands and MCP tools.

hodlmm-range-keeper