The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions frequently use npx awal@latest, which causes the agent to download and execute the latest version of the awal package from the NPM registry at runtime.
[COMMAND_EXECUTION]: The skill relies on shell commands to perform all tasks, including awal x402 bazaar, awal x402 details, and awal x402 pay. This provides the agent with the capability to execute complex CLI operations.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, user-supplied or discovered URLs via the pay and details commands.
Ingestion points: API responses from external URLs provided to the awal x402 pay <url> and awal x402 details <url> commands in SKILL.md.
Boundary markers: No specific delimiters or safety instructions are provided to the agent to treat external API responses as untrusted data.
Capability inventory: The skill possesses network access (via awal), shell command execution (npx), and the ability to process JSON payloads.
Sanitization: There is no evidence of sanitization or validation of the content returned by external endpoints before it is processed by the agent.
[DYNAMIC_EXECUTION]: The use of npx to pull and run the latest version of a CLI tool represents dynamic execution of code that is not pinned to a specific version or local source.

x402