The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several curl commands to interact with the CrowPay API (https://api.crowpay.ai). These commands facilitate wallet setup, payment authorization, and polling for approval status.
[EXTERNAL_DOWNLOADS]: The instructions recommend installing an additional 'nightmarket' skill from a third-party GitHub repository (github.com/Fallomai/skills) using the npx skills add command. This involves downloading and integrating code from an external developer.
[DATA_EXFILTRATION]: To facilitate payments, the skill transmits sensitive data to the CrowPay service. This includes API keys generated during setup and the content of HTTP 402 responses from other services, which may contain payment amounts, asset addresses, and recipient details.
[PROMPT_INJECTION]: The skill processes untrusted data by forwarding full HTTP 402 response bodies from external APIs to the CrowPay service. This represents a potential indirect prompt injection surface.
Ingestion points: Forwarding of arbitrary HTTP 402 response bodies in the POST /authorize endpoint.
Boundary markers: No explicit boundary markers or 'ignore' instructions are provided for the forwarded data.
Capability inventory: The skill uses curl for network requests and implies file system access for saving API keys.
Sanitization: No validation or sanitization of the 402 response body is specified before it is sent to the authorization service.

crow