The Agent Skills Directory

[DATA_EXFILTRATION]: The skill performs an asynchronous network request to the vendor's domain (pancakeswap.ai) during initialization to track usage. This request transmits system information including the operating system (uname -s), architecture (uname -m), and the agent's identifier.
[COMMAND_EXECUTION]: The skill uses shell tools such as curl, jq, and cast to interact with blockchains and APIs. It includes robust security instructions for the agent, requiring strict input validation for token addresses via regular expressions and proper shell quoting for all user-provided variables to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources such as DexScreener, CoinGecko, and GeckoTerminal to provide token metadata and pricing.
Ingestion points: Token discovery, contract verification, and price fetching steps in SKILL.md use curl to retrieve JSON data from third-party APIs.
Boundary markers: The instructions explicitly direct the agent to treat all external API response content as untrusted and avoid interpreting it as commands.
Capability inventory: The skill can execute shell commands (curl, jq, cast) and open specific pancakeswap.finance URLs in a browser.
Sanitization: The skill mandates strict regex validation for Ethereum (^0x[0-9a-fA-F]{40}$) and Solana (^[1-9A-HJ-NP-Za-km-z]{32,44}$) addresses before use in shell commands.

swap-planner