The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the run402 and buzz command-line tools to manage user profiles, generate identity links, and verify Nostr-based proofs. These operations are performed using spawnSync with shell: false, which prevents shell-based command injection by passing arguments as a controlled array.
[EXTERNAL_DOWNLOADS]: The setup script downloads and installs the run402 package via the official NPM registry using npm install -g run402@latest. This download targets a well-known package manager and a package owned by the skill's author, aligning with the skill's stated purpose of tool installation.
[CREDENTIALS_UNSAFE]: The skill implements proactive sanitization measures to prevent the accidental exposure of sensitive information. The rejectSecretFields function in buzz-publish-proof.mjs and the SECRET_OUTPUT filter in setup.mjs scan for patterns resembling private keys, mnemonics, or session tokens in tool outputs, blocking execution if such data is detected.

run402-buzz