The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the cg CLI tool to fetch market data. It uses non-interactive commands and inspects the command catalog (cg commands -o json) to ensure only supported operations are performed.
[INDIRECT_PROMPT_INJECTION]: The skill manages potential injection through user-supplied coin names and symbols by routing them through a validation script. The scripts/build-url.py utility uses a strict regex (^[a-z0-9]+(?:-[a-z0-9]+)*$) for coin IDs and standard date parsing, preventing malicious strings from influencing the generated URLs or command arguments.
[REMOTE_CODE_EXECUTION]: A mechanism for updating the CLI tool (cg update) is documented but requires explicit user approval and provides a dry-run option, mitigating the risk of unauthorized software changes.
[DATA_EXFILTRATION]: The instructions contain a clear directive to never expose API keys or private wallet data to external endpoints, maintaining a focus on public market data.
[DYNAMIC_EXECUTION]: The skill utilizes a Python helper script via the uv runner. This script is used solely for URL construction and contains robust input validation to ensure safety during execution.

cli-coingecko