The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requires the user to provide a wallet private key via the GMFARCASTER_PRIVATE_KEY environment variable or the GMFARCASTER_PRIVATE_KEY_FILE file path. Handling raw cryptographic private keys in the process environment or local filesystem is a high-risk practice, as it increases the risk of credential exposure or theft if the environment is compromised.
[COMMAND_EXECUTION]: The skill instructions and catalog entry direct the user and the agent to execute shell commands, specifically pip install for dependency management and python scripts/query.py for performing queries. The use of shell-based execution for queries requires careful handling of user input to prevent command injection at the shell level.
[EXTERNAL_DOWNLOADS]: The skill fetches external Python dependencies from PyPI and communicates with the Warpee Knowledge API at api.gmfarcaster.com. It also references the x402.org protocol and a public GitHub repository for documentation purposes.
[PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection as it processes and displays content from an external API.
Ingestion points: The scripts/query.py script retrieves JSON data (answer and citations) from the api.gmfarcaster.com endpoint.
Boundary markers: There are no programmatic boundary markers or sanitization logic in the script; however, the SKILL.md documentation includes a warning instructing the agent to treat the API's answers and citations as untrusted content.
Capability inventory: The skill environment has the capability to perform network requests and access the local filesystem (to read the private key file).
Sanitization: The script does not perform sanitization or filtering on the retrieved API content before it is processed or printed.

gmfarcaster