The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from on-chain sources (e.g., token names and symbols) and displays it in reports provided to the agent. An attacker could potentially craft a token name containing instructions designed to manipulate the agent's behavior when the audit is performed.
Ingestion points: scripts/approval_scanner.py fetches token metadata directly from the blockchain via eth_call. scripts/tx_analyzer.py retrieves contract information from block explorer APIs.
Boundary markers: No explicit delimiters or instructions are provided to the agent to treat these specific data fields as untrusted or to ignore instructions embedded within them.
Capability inventory: The agent has access to file system and command-line tools (Bash, Write, Edit, Read, Grep, Glob), creating a risk if malicious instructions are processed from a token name and executed.
Sanitization: The scripts decode blockchain hex data into UTF-8 strings but do not filter for control characters, escape sequences, or specific prompt injection patterns.
[DATA_EXFILTRATION]: The skill performs network operations to retrieve blockchain data.
Evidence: scripts/approval_scanner.py and scripts/tx_analyzer.py use the requests library to communicate with blockchain RPC providers (e.g., eth.llamarpc.com, bsc-dataseed1.binance.org) and block explorer APIs (e.g., api.etherscan.io, api.bscscan.com). These are recognized as well-known and legitimate services required for the skill's primary function of wallet auditing.

auditing-wallet-security