The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and run the @covalenthq/goldrush-cli package from the NPM registry. This is a vendor-owned resource provided by the skill author.
[REMOTE_CODE_EXECUTION]: By using npx, the skill executes remote code from the NPM registry at runtime. This behavior is documented as a vendor-specific deployment method for the CLI tool.
[COMMAND_EXECUTION]: The skill's primary functionality is delivered through the execution of the goldrush command-line utility, which interacts with external blockchain APIs and the local environment.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external blockchain networks (e.g., wallet balances, DEX pairs, token names), which represents a vulnerability surface for indirect prompt injection.
Ingestion points: Data enters the agent context through commands like goldrush balances, goldrush watch, and goldrush new_pairs defined in SKILL.md and references/overview.md.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are included in the skill's handling of external data.
Capability inventory: The skill allows the agent to execute a variety of blockchain-related commands and stream real-time activity.
Sanitization: There is no evidence of sanitization or filtering of the content retrieved from blockchain sources before it is presented to the agent.

goldrush-cli