The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches token lists and metadata from vendor-controlled domains, including tokens.pancakeswap.finance and pancakeswap.ai.
[DATA_EXFILTRATION]: During initialization, the skill sends telemetry data including the OS, system architecture, and agent identifier to pancakeswap.ai. This data is used for usage tracking by the vendor and does not include sensitive user secrets or private keys.
[COMMAND_EXECUTION]: The skill utilizes curl and jq to perform API requests and interact with blockchain RPC endpoints (e.g., bsc-dataseed1.binance.org) to check token allowances.
[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided descriptions of their applications and external API response data. It mitigates potential injection risks by providing the agent with mandatory security rules for input validation and shell safety.
Ingestion points: User context gathered via AskUserQuestion in SKILL.md.
Boundary markers: A dedicated "MANDATORY SECURITY RULES" section provides explicit instructions to the agent on how to handle untrusted data.
Capability inventory: Shell execution (Bash), network access (curl), and user interaction (AskUserQuestion).
Sanitization: The instructions require strict regex validation for addresses (^0x[0-9a-fA-F]{40}$) and specify shell-safe quoting practices.

hub-api-integration