The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the user to export a wallet private key using mp wallet export and paste it into the /corbits init command. While the skill includes a security warning, this workflow requires the manual handling of raw private keys, which can lead to exposure in shell history, clipboard buffers, or agent logs.
[EXTERNAL_DOWNLOADS]: The skill installs dependencies from external registries at runtime, including clawhub via npx and @moonpay/cli via npm.
[COMMAND_EXECUTION]: The skill executes multiple shell commands for wallet management, funding, and project scaffolding. It also includes an auto top-up script that pipes balance data to jq and bc for conditional logic.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill retrieves data from third-party API proxies (e.g., weather, crypto prices) through the /corbits call command (SKILL.md).
Boundary markers: None are present to distinguish between data and potential instructions in the API responses.
Capability inventory: The skill has capabilities for network access (https://api.corbits.dev), file system writes (~/.config/corbits/), and shell command execution.
Sanitization: No explicit sanitization or validation of the external API payloads is documented.

corbits-marketplace