The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the awal package from the npm registry at runtime.
[COMMAND_EXECUTION]: The skill instructs the agent to execute bash commands to interact with the x402 bazaar marketplace and probe third-party URLs for payment requirements.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, such as marketplace search results and service metadata, which could contain malicious instructions designed to influence the agent.
Ingestion points: Data retrieved from npx awal@latest x402 bazaar search and npx awal@latest x402 details <url> (SKILL.md).
Boundary markers: No explicit markers or instructions are provided to help the agent distinguish between trusted instructions and untrusted external data.
Capability inventory: The agent has shell execution capabilities via the Bash tool, as defined in the allowed-tools configuration.
Sanitization: The instructions do not specify any validation or sanitization of the content fetched from external network requests before it is presented to the model.

search-for-service