The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill references and installs official packages from the vendor 'circlefin' (e.g., @circle-fin/app-kit, @circle-fin/bridge-kit, and various adapters). These are standard dependencies for the skill's intended functionality.
[CREDENTIALS_UNSAFE]: The documentation explicitly instructs users to use environment variables (e.g., PRIVATE_KEY, CIRCLE_API_KEY) and strictly forbids hardcoding, committing, or logging secrets. It includes security rules requiring .gitignore entries for secret files.
[COMMAND_EXECUTION]: The skill provides standard npm install commands for setup and demonstrates standard JavaScript/TypeScript SDK usage. There are no suspicious shell executions or dynamic code patterns.
[PROMPT_INJECTION]: The skill includes robust 'Security Rules' that instruct the agent to refuse requests that conflict with safety guidelines, such as hardcoding keys or bypassing user confirmation for mainnet transfers.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-provided inputs like chain names and addresses. It mitigates risk by enforcing a 'Decision Guide' and mandatory input validation rules before submitting any blockchain operations.

bridge-stablecoin