The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses curl to fetch market data and xdg-open or open to facilitate opening deep links in the user's browser. These operations are limited to specific, well-known domains and are part of the core functionality.
[EXTERNAL_DOWNLOADS]: Fetches pool metrics and yields from well-known services (DexScreener and DefiLlama). These are documented as data-fetching operations rather than script execution.
[INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface by processing user input and web-discovered token addresses. However, it implements comprehensive mitigations:
Strict regex validation for token addresses (^0x[a-fA-F0-9]{40}$) and amounts.
Rejection of shell metacharacters in any input used in commands.
Mandatory user confirmation via AskUserQuestion for any data sourced from WebSearch.
Explicit labeling of untrusted sources in the final output.

liquidity-planner