The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs network requests to fetch market data from the Bitflow public API (https://app.bitflow.finance/api) and the Hiro API. These domains are external to the standard whitelisted services and represent a minor privacy consideration as IP addresses are shared with these providers.
[INDIRECT_PROMPT_INJECTION]: The skill processes and displays data from external APIs (Hiro and Bitflow). While the skill's capabilities are restricted to read-only output, this creates a potential surface where malicious strings returned by these APIs could influence an agent's interpretation.
Ingestion points: Data is ingested in yield-dashboard.ts via fetch calls to the Hiro API (contract states and balances) and the Bitflow API (pool statistics).
Boundary markers: The skill does not implement boundary markers or instructions to isolate the external API data from the agent's context.
Capability inventory: The skill is limited to printing JSON output to the console. It lacks capabilities to write to the file system, execute shell commands, or perform authenticated network operations.
Sanitization: The skill does not sanitize strings received from external APIs before including them in the output.
[METADATA_POISONING]: There is an inconsistency between the system-provided author ('aibtcdev') and the author metadata field in SKILL.md ('cocoa007'). While not necessarily malicious, this discrepancy in identity information is a metadata quality issue.

yield-dashboard