The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions and reference documents guide users to clone official repositories from the masumi-network GitHub organization, such as the Payment Service, Kodosumi runtime, and Cardano Toolbox. It also mentions installing vendor-specific packages like masumi, kodosumi-cli, and @sokosumi/mcp-server. These downloads target the vendor's own infrastructure and are documented as standard setup procedures.
[COMMAND_EXECUTION]: Workflows include typical development and installation commands such as npm install, pip install, and database migration commands like npm run db:migrate. These are intended for setting up the self-hosted environment required for the skill's functionality.
[INDIRECT_PROMPT_INJECTION]: The skill defines an API standard (MIP-003) where agents ingest input_data from external purchasers, creating a surface for indirect prompt injection. However, the documentation provides extensive remediation guidance, emphasizing strict JSON-Schema validation in the /input_schema endpoint, cryptographic hashing of inputs and outputs (MIP-004) for verification, and human-in-the-loop checkpoints.
[CREDENTIALS_UNSAFE]: While the skill involves managing API keys and blockchain mnemonics, it includes a mandatory 'Safe API-Key Handling' section. It instructs users to use .env files, exclude them from version control via .gitignore, and explicitly forbids logging or printing keys, which aligns with security best practices for credential management.

masumi