The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill manages sensitive cryptographic private keys and mnemonics. It provides functionality to generate new wallets and store their credentials in the local directory ~/.nad-wallet/. The implementation follows security best practices by using restricted file permissions (0o600 for JSON wallet files and 0o400 for mnemonic backups) and recommending the use of environment variables (NAD_PRIVATE_KEY) to avoid persistent storage of keys.\n- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill performs network operations to api.nadmail.ai to facilitate Sign-In with Ethereum (SIWE) for the NadMail service. This process involves the agent signing an authentication message and submitting the signature and handle to the API. These operations are limited to the specific ecosystem services described in the skill's primary purpose.\n- [INDIRECT_PROMPT_INJECTION]: The skill interacts with an external API which presents an attack surface for indirect prompt injection via data ingestion.\n
Ingestion points: scripts/nadmail-register.js consumes JSON responses from the /api/auth/start and /api/auth/agent-register endpoints of api.nadmail.ai.\n
Boundary markers: The skill does not implement specific delimiters or instruction-bypass warnings when processing strings from the API response (e.g., the SIWE message to be signed).\n
Capability inventory: The skill possesses file system write access (fs.writeFileSync) and network communication capabilities (fetch).\n
Sanitization: There is no explicit sanitization or validation of the content received from the external API before it is processed by the agent for signing.

nad-wallet