The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the @getalby/cli package using npx. This package is the official CLI tool provided by the vendor 'getAlby' and is version-pinned to @0.10.0.- [COMMAND_EXECUTION]: The agent executes shell commands via the Alby CLI to perform Bitcoin wallet operations like balance checks, sending payments, and creating invoices.- [REMOTE_CODE_EXECUTION]: The use of npx -y @getalby/cli@0.10.0 involves executing remote code at runtime. This is the primary mechanism for the skill's functionality and uses a specific version from the vendor.- [PROMPT_INJECTION]: The skill fetches data from external paid API endpoints via the fetch command, creating a surface for indirect prompt injection. 1. Ingestion points: Response bodies from external HTTP 402 services (SKILL.md). 2. Boundary markers: None present for the external data. 3. Capability inventory: Wallet operations such as pay and send (SKILL.md). 4. Sanitization: Absent, but the skill implements a default --max-amount cap of 5000 sats to limit financial exposure.- [DATA_EXFILTRATION]: The skill manages sensitive Bitcoin wallet connection secrets. It follows security best practices by directing the agent to store these in a secure local directory (~/.alby-cli/) or use environment variables, and it explicitly prohibits the agent from sharing or printing these secrets.

alby-bitcoin-payments