The Agent Skills Directory

[OBFUSCATION]: Use of mixed-script homoglyphs in code identifiers to imitate Latin words.
Evidence: The variable reeферMultiplier in references/carbon-tracking.md (lines 142 and 147) uses a combination of Latin and Cyrillic characters. It uses Cyrillic 'ф' (U+0444), 'е' (U+0435), and 'р' (U+0440) to visually imitate the Latin word 'reefer'. This technique is often used to evade keyword-based security filters or to create deceptive code that is difficult to audit.
[OBFUSCATION]: Suspicious identifier formatting suggesting the presence of hidden characters.
Evidence: In references/dscsa.md, the modifier dscsa ProductStatusCheck (line 120) and its application external dscsa ProductStatusCheck(serialNumber) (line 123) contain a space character between 'dscsa' and 'ProductStatusCheck'. In Solidity, identifiers cannot contain spaces. This pattern indicates the likely use of zero-width characters (such as U+200B) to visually separate words while technically remaining a single, valid identifier, which can be used to hide the true name of a function or modifier from automated tools.
[INDIRECT_PROMPT_INJECTION]: Attack surface for indirect prompt injection via untrusted developer input.
Ingestion points: The skill is designed to take user-provided contract requirements, regulatory descriptions, and logistics data (as described in SKILL.md frontmatter) and transform them into Solidity code.
Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between the system's safe templates and potentially malicious instructions embedded in user-supplied contract specifications.
Capability inventory: The skill has the capability to generate complex smart contract logic, including financial transfers (e.g., safeTransfer in SKILL.md) and access control modifications.
Sanitization: There is no evidence of sanitization or validation of external input before it is interpolated into the contract generation process.

solidity-supply-chain-us