The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes external tools like npm, buzz, and run402 using spawnSync with shell: false. This design prevents command injection by ensuring arguments are not interpreted by a shell.
[EXTERNAL_DOWNLOADS]: Installs the run402 package globally using npm install -g. This is a vendor-provided tool necessary for the skill's purpose.
[SAFE]: The skill implements a "hard boundary" policy, explicitly instructing the agent and helper scripts to never read or export private keys, mnemonics, or other sensitive credentials.
[SAFE]: Employs a specialized strict JSON parser to prevent potential vulnerabilities related to duplicate keys or malformed structures in communication between tools.
[SAFE]: Includes robust error handling that automatically redacts secret-shaped patterns (e.g., nsec, private keys) from command output to prevent accidental data exposure.

run402-buzz