The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes Puppeteer in scripts/extract-wc-uri.js to automate browser interactions, including navigating to the EtherMail login page, clicking interface elements, and searching the Shadow DOM.
[EXTERNAL_DOWNLOADS]: The skill requires the puppeteer Node.js package and suggests the installation of an external walletconnect-agent skill for signing operations.
[CREDENTIALS_UNSAFE]: The documentation in SKILL.md includes examples of using a PRIVATE_KEY environment variable. It includes explicit security notes advising users never to commit private keys and to use secure storage methods.
[DATA_EXFILTRATION]: The script extract-wc-uri.js extracts a WalletConnect session URI from the browser context. This URI is output to stdout for use by the local signing agent and is not transmitted to unauthorized external domains by the skill's code.
[PROMPT_INJECTION]: The instructions include a Telegram Mini App link containing an affiliate ID (afid_6986e9a5c5a97b905a78c390). While this serves the author's incentive, it does not constitute a malicious prompt injection or security bypass.

ethermail