The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill dynamically generates a temporary JavaScript wrapper file at runtime within the system's temporary directory. This wrapper is then executed via Bun to bridge wallet credentials to the hodlmm-move-liquidity tool, using import() on a script path resolved from environment variables.\n- [COMMAND_EXECUTION]: The script invokes external CLI tools via Bun.spawn. Specifically, it executes the hodlmm-move-liquidity command, with the target binary or script path determined by the HODLMM_MOVE_LIQUIDITY_CMD environment variable or system PATH resolution.\n- [CREDENTIALS_UNSAFE]: The skill extracts the wallet's sensitive private key (stxPrivateKey) and exposes it to subprocesses by setting the STACKS_PRIVATE_KEY environment variable. This method of credential passing can potentially leak secrets through environment logging, process inspection, or unintended inheritance by other child processes.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple Bitflow API endpoints to determine yield routing, which could be manipulated to influence agent behavior or capital allocation.\n
Ingestion points: Fetches pool metadata, quotes, and bin data from bff.bitflowapis.finance.\n
Boundary markers: The agent is instructed to use doctor and status commands to manually verify decisions, and the code implements safety gates for TVL, volume, and price divergence.\n
Capability inventory: Possesses the ability to write to the blockchain (zest.supply) and execute arbitrary local commands (Bun.spawn).\n
Sanitization: The skill performs numeric conversion and comparison against defined thresholds but does not strictly sanitize the string-based API content before internal processing or output to the agent context.

sbtc-yield-maximizer