The Agent Skills Directory

[SAFE]: The skill exclusively communicates with the vendor's infrastructure at app.capacitr.xyz and standard blockchain explorers like basescan.org for its core market analysis and payment verification features.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it ingests and processes untrusted data from URLs and user-supplied text. Ingestion points: Input is received via the url and query parameters passed to the /api/analyze-link endpoint, as documented in SKILL.md and scripts/analyze.sh. Boundary markers: The skill provides a specific safety section in SKILL.md titled 'Untrusted content', which explicitly instructs the agent to treat all returned strings as untrusted and to ignore any embedded directives or instructions. Capability inventory: The skill's capabilities are restricted to standard web requests using curl and JSON parsing using jq. Sanitization: The skill relies on the agent's adherence to the provided safety instructions and the vendor API's internal processing filters.
[COMMAND_EXECUTION]: The included shell scripts (scripts/analyze.sh and scripts/discovery.sh) utilize curl and jq to interact with the API. These scripts handle user-provided input securely by using jq to construct JSON objects, which prevents shell command injection during the request process.

capacitr