The Agent Skills Directory

[COMMAND_EXECUTION]: The publishPackage and upgradePackage functions in examples/deploy-module/README.md and SKILL.md use the execSync function to call the Sui CLI. The packagePath variable is interpolated directly into the shell command string (e.g., `sui move build ... --path ${packagePath}`) without any validation or escaping. If an AI agent were to execute these functions using a path provided by an untrusted user, it could lead to arbitrary shell command execution on the host system.
[EXTERNAL_DOWNLOADS]: The skill's documentation and Move.toml configuration files reference the official MystenLabs GitHub repository (https://github.com/MystenLabs/sui.git) for installing the Sui CLI and fetching framework dependencies. These are well-known and authoritative sources for the Sui ecosystem.
[PROMPT_INJECTION]: The skill facilitates the retrieval of on-chain data, which presents a surface for indirect prompt injection.
Ingestion points: Data enters the agent's context through client.getCoins, client.getOwnedObjects, client.getObject, and client.queryEvents as seen in examples/read-chain-state/README.md.
Boundary markers: The provided examples do not use explicit delimiters or instructions to ignore embedded commands when processing retrieved chain data.
Capability inventory: Across its scripts, the skill has the capability to sign and execute on-chain transactions (signAndExecuteTransaction) and execute system commands (execSync).
Sanitization: There is no evidence of escaping, validation, or filtering of the content retrieved from the blockchain before it is used in logic or presented to the agent.

sui