The Agent Skills Directory

[CREDENTIALS_UNSAFE]: Sensitive information, including encryption passwords and 24-word BIP39 mnemonics, is passed to the skill as command-line arguments (e.g., --password, --mnemonic, --old-password). These secrets are often visible to other users on the system via process listing tools (like ps) and are typically recorded in plaintext within the user's shell history files (e.g., .bash_history or .zsh_history).- [DATA_EXPOSURE]: The export subcommand outputs the wallet's BIP39 mnemonic phrase in plaintext JSON. In the context of an AI agent, this sensitive secret is ingested into the LLM's conversation context. This creates a risk where the mnemonic could be leaked or exfiltrated if the agent is subsequently compromised or manipulated by malicious instructions.- [DATA_EXPOSURE]: The status command in wallet.ts checks for the presence of a mnemonic in the CLIENT_MNEMONIC environment variable. Secrets stored in environment variables can be exposed through system debugging, process information, or environment dumps.- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from an external source via the getStxBalance function in wallet.ts (calling hiro-api.js). While this data is expected to be numeric, the ingestion of untrusted external content represents a surface for indirect prompt injection.
Ingestion points: hiro-api.js data processed in wallet.ts.
Boundary markers: None present in the CLI wrapper to distinguish API data from instructions.
Capability inventory: The skill has file-write access to ~/.aibtc/ and performs sensitive wallet management operations.
Sanitization: No explicit sanitization of API responses is visible in the provided CLI code.

wallet