The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell-based execution of Node.js and CLI tools to perform cryptographic signing and wallet management.
Evidence: Multiple files (e.g., references/mpp/authentication.md, references/x402/wallet-bootstrap.md) provide node -e commands for generating SIWE/SIWS tokens and managing wallets.
[EXTERNAL_DOWNLOADS]: The skill requires the installation of external Node.js packages for core functionality.
Evidence: Instructions mention installing viem, mppx, @alchemy/x402, and other well-known libraries from standard registries.
[PROMPT_INJECTION]: The skill identifies and documents risks associated with processing untrusted blockchain data (Indirect Prompt Injection).
Ingestion points: NFT metadata, token names, and collection descriptions retrieved from external blockchain providers.
Boundary markers: Absent in standard request examples; documentation relies on developer implementation.
Capability inventory: File system access, network operations (curl/fetch), and dynamic script execution via Node.js.
Sanitization: Documentation in references/data-nft-api.md explicitly warns to treat metadata as untrusted and to sanitize output before displaying it to users.
[DATA_EXFILTRATION]: High-value private keys are managed locally with specific instructions to prevent accidental exposure.
Evidence: Setup guides mandate the use of shell pipes (> wallet-key.txt) to bypass stdout and instructions to include key files in .gitignore to prevent repository leakage.

alchemy