The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the installation of an external Python package blockrun-llm. This package is responsible for sensitive operations, including managing a local crypto wallet and routing financial payments for API access.
[COMMAND_EXECUTION]: Utilizes the Bash tool to execute Python scripts that interact with the local filesystem and external APIs. It specifically manages a hidden session directory ($HOME/.blockrun/) which likely contains wallet private keys or session tokens.
[PROMPT_INJECTION]: The skill provides deceptive information in its metadata and instructions by claiming support for non-existent AI models (e.g., GPT-5.2, o4-mini, Gemini 2.5). This misleading information could be used to entice users into depositing funds into the integrated wallet under false pretenses.
[PROMPT_INJECTION]: The skill architecture is vulnerable to indirect prompt injection (Category 8). It ingests content from external sources (such as real-time X/Twitter data and third-party LLM responses) and provides it to the agent without proper delimiters or sanitization.
Ingestion points: Data retrieved via the blockrun_llm client (e.g., client.chat() or ImageClient.generate()) as seen in SKILL.md.
Boundary markers: Absent. The agent is not instructed to treat data from these external tools as untrusted.
Capability inventory: The skill has broad capabilities including file reading and shell command execution via Python.
Sanitization: No evidence of sanitization or validation for content returned from external APIs before it is processed by the agent.

blockrun