The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires installing an external Python package blockrun-llm using pip install. This package is not from a recognized trusted vendor and manages financial transactions.
[DATA_EXFILTRATION]: The skill accesses and manages a sensitive filesystem path at $HOME/.blockrun/.session to store wallet credentials and session data. Accessing credential storage locations is a high-risk operation that could lead to the exposure of financial assets.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources, including real-time X/Twitter data and responses from external AI models, which creates a significant attack surface.
Ingestion points: External data enters the agent context via client.chat() responses and search results from the blockrun-llm SDK.
Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the scripts that process external data.
Capability inventory: The skill is granted extensive shell access through Bash(python:*), Bash(pip:*), and Bash(source:*), which could be exploited if malicious instructions are ingested.
Sanitization: The skill lacks validation or sanitization of content returned from external model providers.
[COMMAND_EXECUTION]: The skill uses the Bash tool to perform package management, script execution, and environment configuration, providing a large privilege surface for the SDK logic.
[METADATA_POISONING]: The skill documentation and metadata reference non-existent model versions such as openai/gpt-5.2, which may be deceptive or intended to lure users into using an unverified payment-routing service.

blockrun