The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata (such as token symbols and names) fetched from the Solana blockchain via the onchainos CLI. This data could contain malicious instructions intended to influence the agent's behavior.
Ingestion points: The get_wallet_holdings function in wallet_tracker.py and various functions in risk_check.py fetch token-related strings from the blockchain.
Boundary markers: SKILL.md includes a dedicated 'External Data Boundary' section that explicitly instructs the AI to treat all data from the CLI as untrusted and ignore embedded instructions.
Capability inventory: The skill can perform on-chain writes, including buying and selling tokens, via the onchainos CLI.
Sanitization: The skill implements a whitelist of 'Safe Fields for Display' and requires a specific typed confirmation ('confirm live trade') before entering live mode.
[COMMAND_EXECUTION]: The skill relies on executing shell commands to interact with the onchainos CLI for data retrieval and transaction broadcasting.
Evidence: wallet_tracker.py and risk_check.py use subprocess.run to call the CLI tool. Commands are passed as lists without shell=True, which mitigates standard command injection risks, but the reliance on external CLI arguments remains an active capability.
[DYNAMIC_EXECUTION]: The skill includes a setup wizard that modifies its own configuration file at runtime.
Evidence: The interactive_setup and _save_config_to_disk functions in wallet_tracker.py use regular expressions to overwrite values in config.py based on user input. While this is a functional feature for bot configuration, it involves self-modifying code patterns.

wallet-tracker-mcap