The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes base64-encoded PSBT strings provided as user input, which could potentially contain malicious structures or metadata.
Ingestion points: The psbt argument in estimate-fee, sign, and broadcast subcommands in psbt.ts.
Capability inventory: The skill can sign transaction inputs using private keys (tx.signIdx) and broadcast transactions to the Bitcoin network (mempool.broadcastTransaction).
Boundary markers: The AGENT.md file contains logic to prevent signing index 0 (seller input), but there are no programmatic delimiters to isolate the PSBT content from the agent's control flow.
Sanitization: The skill uses the @scure/btc-signer library to decode and validate the PSBT structure, which provides a layer of protection against malformed data.
[COMMAND_EXECUTION]: The skill facilitates the broadcasting of transactions to the public Bitcoin network.
The broadcast command in psbt.ts takes a finalized PSBT and submits it to the mempool.space API, resulting in an immutable change to the Bitcoin ledger.
[CREDENTIALS_UNSAFE]: The skill programmatically accesses sensitive Bitcoin private keys.
Evidence: In psbt.ts, the sign command retrieves the active account from walletManager and accesses account.btcPrivateKey and account.taprootPrivateKey to perform signing operations.

psbt