The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions prompt the user to install external dependencies and skill logic from third-party repositories and registries.
Evidence: npx skills add EmblemCompany/Agent-skills --skill emblem-ai-agent-wallet and npm install @emblemvault/agentwallet in SKILL.md.
[REMOTE_CODE_EXECUTION]: By recommending the execution of npx and npm install for third-party packages, the skill triggers the download and execution of code whose integrity and safety cannot be verified statically within the skill folder.
Evidence: Use of npx to fetch and execute a remote skill definition from the EmblemCompany GitHub repository.
[COMMAND_EXECUTION]: The skill documentation includes shell commands for package management and installation that interact with the system environment.
Evidence: Installation blocks in the 'Setup' section of SKILL.md.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface where untrusted data from external blockchain APIs is ingested into the agent context, potentially influencing its behavior if the external data contains malicious instructions.
Ingestion points: Data returned from api.agenthustle.ai via endpoints like /token (token names/descriptions) and /portfolio in SKILL.md.
Boundary markers: No explicit prompt boundaries or 'ignore' instructions are defined for the data returned by the API.
Capability inventory: The skill has the capability to perform high-stakes financial operations including /transfer and /swap as defined in the API Integration section of SKILL.md.
Sanitization: There is no evidence of sanitization or validation of the external API content before it is processed by the agent.

emblemai-crypto-wallet