The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The README.md and install.sh files utilize a pattern where an installation script is fetched via curl and piped directly into sh. While this pattern is generally high-risk, in this context, the source is the official repository of the skill's author (BofAI/skills), which is consistent with standard installation practices for this type of tool.
[EXTERNAL_DOWNLOADS]: The install.sh script performs several external operations: it clones the skill's repository from GitHub (https://github.com/BofAI/skills.git) and installs the Node.js package @bankofai/x402-cli globally using npm. These resources originate from the vendor's own infrastructure and are necessary for the skill's primary function.
[COMMAND_EXECUTION]: The SKILL.md file provides instructions for the agent to execute shell commands using the x402-cli. These commands include payment processing, wallet inspection, and relayer configuration. The instructions include security best practices such as using --dry-run and --max-amount to prevent unintended large transactions.
[SAFE]: The skill implements safety rules to protect user credentials, explicitly instructing the agent never to print, echo, or interpolate private keys or mnemonics into shell commands, relying instead on environment variables or internal CLI resolution.

x402-payment