The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The installation instructions direct users to clone a repository from an untrusted GitHub account (happyboy4ty25/pump-analyzer). The source is not associated with any recognized or trusted organization.
[COMMAND_EXECUTION]: The skill provides shell commands for cloning and serving the application locally (git clone, python3 -m http.server, npx serve), which facilitates the execution of code from the untrusted repository.
[INDIRECT_PROMPT_INJECTION]: The skill processes real-time token metadata from a third-party WebSocket (pumpportal.fun) and interpolates it into the DOM, creating an attack surface for data-driven injection.
Ingestion points: Token information such as name, symbol, mint, and imageUri are received through the pumpportal.fun WebSocket API.
Boundary markers: No isolation or sanitization headers are present to protect the execution environment from malicious payload delivery via the data stream.
Capability inventory: The skill uses innerHTML for rendering token cards and binds user-controlled strings to inline event handlers (onclick) and image source attributes.
Sanitization: The escapeHtml function is selectively applied; however, the token.mint and token.imageUri properties are injected directly into HTML attributes, which allows for DOM-based XSS (e.g., breaking out of the onclick attribute or src attribute).

pump-analyzer-solana