The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch data from a non-whitelisted domain, https://api.tenero.io, for market statistics and token information.
[DATA_EXFILTRATION]: The skill transmits user-related data to an external service.
Evidence: The wallet-holdings and wallet-trades subcommands in tenero.ts retrieve the user's active Stacks wallet address via a local service and send it to https://api.tenero.io to fetch financial history and holdings.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and displays data from an external third-party API, providing an attack surface for instructions embedded in data to influence the agent.
Ingestion points: The fetchTenero function in tenero.ts is used by all subcommands to ingest data from various API endpoints.
Boundary markers: There are no boundary markers or instructions to the agent to treat the external data as untrusted or to ignore embedded commands.
Capability inventory: The skill provides comprehensive read-only access to token metadata, market summaries, and wallet transactions.
Sanitization: The skill does not sanitize or validate the content returned by the API (e.g., token names, symbols, or search results) before outputting it to the agent's context.

tenero