The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using variables provided by untrusted external sources, such as service URLs and custom headers retrieved from a marketplace. Although the skill provides specific validation rules (e.g., checking for shell metacharacters and specific character sets) to mitigate this risk, the pattern of dynamic command construction based on external seller-controlled strings remains a potential vulnerability surface.
[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external, third-party service providers into the agent's context, which could be used to influence the agent's behavior via malicious content in API responses.
Ingestion points: External data is ingested through the results of circle services search and the final response payload from circle services pay (identified in SKILL.md and references/inspect.md).
Boundary markers: The skill does not provide instructions to wrap the external API response content in delimiters or use safety warnings to prevent the agent from obeying instructions embedded in that data.
Capability inventory: The agent is authorized to use shell commands via Bash and perform blockchain transactions, including circle wallet transfer, which could be abused if the agent is compromised by malicious data.
Sanitization: The skill explicitly sanitizes header names, header values, and service URLs, but lacks specific sanitization or escaping instructions for the primary data payload returned by the paid services.

pay-via-agent-wallet