The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes untrusted content from external sources including news feeds and social media posts, creating a surface for indirect prompt injection attacks where malicious instructions could be embedded in the retrieved data.
Ingestion points: Data enters the agent's context through several endpoints described in SKILL.md, such as /surf/news/feed, /surf/social/tweets, and /surf/social/user/posts.
Boundary markers: The instructions do not specify any delimiters or safety guidelines for the agent when processing the results from these external data sources.
Capability inventory: The skill can perform network requests to a local proxy and execute raw SQL queries against a remote database.
Sanitization: There is no mention of content sanitization or filtering for the data returned by social or news endpoints.
[COMMAND_EXECUTION]: The skill facilitates the construction and execution of raw SQL queries against an external ClickHouse database via a POST request to a specific endpoint.
Evidence: The /surf/onchain/sql endpoint allows for the execution of arbitrary SQL SELECT statements as shown in the examples in SKILL.md.
[EXTERNAL_DOWNLOADS]: The skill documentation directs the agent to make network requests to a local proxy at http://127.0.0.1:8402, which forwards requests to a remote service provider.
Evidence: Found in the description and 'Endpoint catalog' sections of SKILL.md.
[DYNAMIC_EXECUTION]: The skill requires the agent to dynamically generate and execute SQL queries based on user intent and a retrieved database schema.
Evidence: The documentation in SKILL.md instructs the agent to fetch the database schema via /surf/onchain/schema and then construct appropriate SQL queries for the /surf/onchain/sql endpoint.

surf