The Agent Skills Directory

[COMMAND_EXECUTION]: The skill preamble and telemetry sections execute several shell commands, including 'cat', 'grep', 'sed', 'uname', and 'mkdir', to manage local state and configuration files located in the '~/.superstack' directory.
[DATA_EXFILTRATION]: The skill features an opt-in telemetry system that uses 'curl' to send skill lifecycle events and system identification data ('uname') to a remote endpoint. The endpoint URL is dynamically retrieved from a local configuration file ('~/.superstack/config.json'). This represents a data exfiltration surface, although it is transparently prompted for user consent.
[EXTERNAL_DOWNLOADS]: The research guide documentation encourages the installation of the '@defillama/api' (Node.js) and 'defillama-sdk' (Python) packages to interact with the DeFi data provider.
[PROMPT_INJECTION]: The skill processes dynamic data from the DefiLlama API, creating a surface for indirect prompt injection. \n
Ingestion points: Data fetched from multiple DefiLlama API endpoints such as '/protocols', '/pools', and '/stablecoins'.\n
Boundary markers: None; the skill instructions do not specify delimiters or instructions to ignore embedded commands within the fetched API data.\n
Capability inventory: The skill has the ability to write to local files (e.g., '.superstack/idea-context.md') and perform network operations for data retrieval and telemetry.\n
Sanitization: No specific sanitization, validation, or filtering mechanisms are described for the external API content before it is used to generate research findings.

defillama-research