The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file lib/defaults.json contains hardcoded API credentials (accessKeyId and accessSecret). These are documented as a public free-tier key pair provided by the author (AiCoin) to allow immediate use of the skill's market data features without initial configuration.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display data from external sources, including real-time newsflashes and social media posts (X/Twitter). As with any skill that processes external content, there is a theoretical surface for indirect prompt injection where malicious text returned by the API could attempt to influence the AI agent's instructions.
Ingestion points: Data is fetched from various endpoints under open.aicoin.com in lib/client.mjs.
Boundary markers: The skill returns data in a structured JSON envelope { ok, data, error, meta } which helps the agent distinguish between data and control flow.
Capability inventory: The skill can perform network requests to the vendor's API and write a local .env file for key storage.
Sanitization: The skill performs JSON parsing and validation of API responses.
[SAFE]: The skill demonstrates security-conscious practices, such as using chmod 0o600 in lib/client.mjs to ensure that local credential files are only readable by the owner. It also includes a tombstone script (scripts/market.mjs) to safely disable legacy entry points that might exist in older workspaces.

aicoin-market