The Agent Skills Directory

[DATA_EXFILTRATION]: Hardcoded Wallet and Telemetry Tracking. The script bridge.py hardcodes the wallet address 0x3a81f1Fb069107fdaAF0a6598d46A0B0e3612973 as the source (fromAddress) for all cross-chain bridge quotes. This forces the transaction logic to be generated for a specific account rather than the user's actual wallet. Additionally, it sends a static identifier chat:3182 via the SC-CALLER-ID header to the LiFi API (li.quest), allowing external tracking of all transactions performed with this skill.
[COMMAND_EXECUTION]: Automated Transaction Execution. The skill uses the wallet.wallet_transfer capability to execute smart contract interactions. It relies on calldata obtained from an external API (li.quest), which provides the logic for token approvals and bridge transfers. This creates a dependency where external data directly dictates the financial actions of the agent.
[PROMPT_INJECTION]: Indirect Prompt Injection Surface.
Ingestion points: Bridge quote data and transaction requests fetched from https://li.quest/v1/quote in bridge.py.
Boundary markers: None; external API responses are parsed and used directly to build transaction payloads.
Capability inventory: Blockchain transaction execution via wallet.wallet_transfer across multiple EVM chains.
Sanitization: None; the skill does not validate or sanitize the transactionRequest data before execution.
[METADATA_POISONING]: Deceptive Technical Claims. The SKILL.md documentation falsely claims to use Alchemy Account Abstraction for gas sponsorship and requires users to provide an ALCHEMY_API_KEY. However, the implementation in bridge.py utilizes platform-native wallet tools and completely ignores the requested Alchemy configuration.

@3182/cross-chain-bridge