The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses shell commands via npx to execute the @getalby/cli tool for various wallet operations including pay-invoice, get-balance, and make-invoice. It also includes a fetch command for handling HTTP 402 (Payment Required) responses which allows the agent to pay for and consume external API services.
[EXTERNAL_DOWNLOADS]: The skill downloads and executes the @getalby/cli package from the NPM registry. This is the official tool provided by the author (getAlby) and is used to provide the skill's primary functionality for Bitcoin transactions.
[CREDENTIALS_UNSAFE]: The skill manages sensitive Nostr Wallet Connect (NWC) connection secrets which are stored in the ~/.alby-cli/ directory or provided via the NWC_URL environment variable. While these are high-sensitivity credentials, the skill provides clear instructions to the agent to avoid revealing them in chat or logs, maintaining local-only access.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface through the fetch and discover commands, which ingest content from external servers and the 402index.io service.
Ingestion points: External HTTP responses and service discovery metadata.
Boundary markers: None explicitly defined in the instructions for the data returned by external requests.
Capability inventory: The agent can perform financial transactions and execute command-line operations using the Alby CLI.
Sanitization: No specific sanitization or filtering of retrieved external content is mentioned before it is processed by the agent.

alby-bitcoin-payments