The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to process and analyze untrusted external data, including transaction payloads, smart contract addresses, and dApp URLs, creating a surface for potential subversion of the agent's reporting.
Ingestion points: As defined in SKILL.md (Step 1), the skill accepts token contracts, wallet addresses, dApp URLs, and transaction payloads from the user for processing.
Boundary markers: The skill utilizes a structured report template to organize findings, although it does not specify the use of explicit delimiters (e.g., XML tags or triple quotes) or 'ignore instructions' warnings when interpolating external data into the agent's context.
Capability inventory: The skill possesses network access via the security_risk toolset and invoke_api_endpoint to communicate with external risk providers (such as GoPlus).
Sanitization: The provided instructions do not detail specific sanitization, escaping, or filtering procedures for external content before it is parsed or summarized by the agent.
[SAFE]: The skill explicitly prohibits asking for or forwarding signing secrets (private keys or mnemonics), which is a critical defensive control for cryptocurrency-related tasks.
[SAFE]: The use of the security_risk toolset and integration with well-known providers like GoPlus are appropriate for the skill's stated purpose and use vendor-managed infrastructure.

hive-security-risk