The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands to execute local TypeScript scripts (scripts/*.ts) via npx tsx. These scripts handle the complexity of request signing and response formatting for the Crypto.com API.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx tsx, a standard utility that may download the tsx package from the official npm registry to execute the TypeScript scripts. This is a common and safe practice in the Node.js ecosystem.
[CREDENTIALS_UNSAFE]: API credentials (CDC_API_KEY, CDC_API_SECRET) are securely managed via environment variables. The skill includes explicit instructions for users to set these variables in their terminal and contains scripts that validate their presence before execution.
[DATA_EXFILTRATION]: Network communication is restricted to the official vendor API endpoint at https://wapi.crypto.com. The skill also implements a security 'Kill Switch' command to revoke the active API key upon user request.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied parameters, such as currency symbols and trade amounts, to construct API requests. The risk is mitigated by the scripts' use of structured JSON parsing and the limited scope of the financial operations performed.

crypto-com-app