The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the user to install external libraries eth-connect and dcl-crypto-toolkit via npm. These are standard libraries provided by or widely used within the Decentraland ecosystem for blockchain interactions.
[COMMAND_EXECUTION]: The documentation includes npm install commands for setting up required blockchain dependencies.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface as it ingests and processes data from untrusted external sources.
Ingestion points: NFT metadata fetched via opensea.decentraland.org, blockchain responses from eth-connect or dcl-crypto-toolkit, and external API responses via signedFetch in SKILL.md and references/blockchain-patterns.md.
Boundary markers: None explicitly defined in the provided snippets to isolate external data from the agent's internal logic.
Capability inventory: The skill facilitates network requests (signedFetch), external URL opening (openExternalUrl), and smart contract interactions (which prompt the user for confirmation and gas).
Sanitization: Code examples show the use of JSON.parse() for API responses, but no specific sanitization or validation logic for the content of the data is demonstrated.
[TIME_DELAYED_CONDITIONAL]: The file references/blockchain-patterns.md contains a specific date-based condition related to the deprecation of the getFingerprint method (November 26, 2026). This is documented as a legitimate technical requirement for API compatibility rather than a malicious trigger.

nft-blockchain