The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file jingswap-v2/jingswap-v2.ts contains a hardcoded API key assigned to JINGSWAP_API_KEY. Hardcoding credentials in source code is a high-severity security risk as it exposes the key to anyone with access to the skill's files.
Evidence: const JINGSWAP_API_KEY = process.env.JINGSWAP_API_KEY || "jc_b058d7f2e0976bd4ee34be3e5c7ba7ebe45289c55d3f5e45f666ebc14b7ebfd0";
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data (cycle state, prices, and clearing previews) from a non-whitelisted API, which directly influences the agent's decision-making logic and transaction parameters.
Ingestion points: Multiple fetch requests in jingswap-v2.ts via the jingswapGet helper function to https://faktory-dao-backend.vercel.app.
Boundary markers: None detected. The skill lacks delimiters or instructions to ignore potentially malicious content embedded in the API responses.
Capability inventory: The skill has the ability to execute blockchain transactions via callContract in jingswap-v2.ts, including depositing funds and settling auctions.
Sanitization: The skill performs basic HTTP status checks and success flag validation, but lacks deep validation of the data content used for transaction parameters.
[DATA_EXFILTRATION]: The skill performs network operations to an external, non-whitelisted domain (faktory-dao-backend.vercel.app) to retrieve auction configuration and state data.
Evidence: const JINGSWAP_API = process.env.JINGSWAP_API_URL || "https://faktory-dao-backend.vercel.app";

jingswap-v2