The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches smart contract bytecode, transaction data, and signature metadata from multiple external services including api.etherscan.io, api.openchain.xyz, and 4byte.directory.
[COMMAND_EXECUTION]: The skill employs extensive shell command pipelines for data processing. This includes fetching data via curl and piping it into python3 -c for JSON parsing. Although flagged by automated scanners, these commands execute static local logic rather than the downloaded remote content.
[DYNAMIC_EXECUTION]: The skill performs runtime compilation and execution of C code for keccak256 brute-forcing (gcc -O3 -o /tmp/keccak_crack /tmp/keccak_crack2.c). It also uses Docker to run specific versions of the Solidity compiler (solc-poc8, solc-jan20, etc.) in isolated containers, which is a powerful execution capability.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect injection as it ingests and processes untrusted data from blockchain explorers and external databases (SKILL.md). While there are no explicit boundary markers to separate this data from agent instructions, the skill primarily focuses on technical hex-string matching rather than natural language interpretation of the ingested content. Evidence Chain:
Ingestion points: Etherscan API, OpenChain API, GitHub Search API, and EthereumHistory API (SKILL.md).
Boundary markers: None identified in the processing steps.
Capability inventory: Shell command execution (curl, node, python3), C compilation (gcc), and container execution (docker).
Sanitization: Not explicitly implemented; the workflow relies on standard parsing of JSON and hex data.

eth-bytecode-cracker