The Agent Skills Directory

[SAFE]: The skill implements a robust trust model that explicitly treats all data from the Supabase database as untrusted hints. It mandates that critical parameters, such as token addresses, escrow addresses, and wager amounts, must be verified against on-chain state before any financial transactions are initiated.
[SAFE]: Includes a dedicated transaction preparation script (scripts/prepareTx.ts) that acts as an execution allowlist. This script restricts outgoing transactions to only the verified $RIDER token and the specific game escrow contract, and limits callable functions to a predefined set of safe operations (transfer, createMatch, joinMatch, etc.), preventing the agent from being redirected to malicious targets.
[SAFE]: Implements a strict two-step funding process in scripts/depositCreate.ts. This logic requires a token transfer to be mined and confirmed on-chain before the subsequent transaction (creating or joining the match) can be prepared, mitigating risks associated with shared-balance vulnerabilities or race conditions.
[SAFE]: Provides comprehensive guidance for implementing backend security via Supabase Row-Level Security (RLS) and SQL triggers in references/matches-rls.sql. This ensures that sensitive database fields, like winners and settlement signatures, can only be modified by authorized service-role accounts.
[SAFE]: Contains explicit instructions for sanitizing user-controlled strings (player handles and track names) retrieved from the database before they are rendered or processed, effectively reducing the risk of indirect prompt injection or UI-based metadata attacks.

rider-battle