The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill's install.command and setup instructions utilize curl to fetch remote content from https://ethskills.com/qa/SKILL.md. It also suggests installing external software via claude plugin install https://github.com/austintgriffith/ethskills and clawhub install ethskills.
[PROMPT_INJECTION]: The skill is designed to ingest and process instructions from an external URL, which creates a vulnerability surface for indirect prompt injection where the remote markdown content could potentially influence the agent's behavior during a dApp audit.
Ingestion points: Remote file https://ethskills.com/qa/SKILL.md (catalog.json).
Boundary markers: None; the skill fetches and interprets the remote content directly as part of its audit logic.
Capability inventory: The skill is intended to audit local dApp code, implying file system read access, and uses network access via curl.
Sanitization: There is no evidence of sanitization or validation performed on the remote instructions before they are presented to the agent.

QA Checklist