The Agent Skills Directory

[COMMAND_EXECUTION]: The script xfree02.py uses subprocess.run() to delegate payment processing and API interactions to a sibling utility, x402/scripts/buy.py. This command is executed using a list of arguments rather than a shell string, which effectively prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The documentation provides instructions for users to manually fetch updated endpoint schemas from docs.nansen.ai using curl. This is a legitimate maintenance task for keeping the local catalog current with the upstream service.
[DATA_EXFILTRATION]: The skill facilitates data requests to community.iamstarchild.com, which acts as a proxy to Nansen's API. This domain belongs to the skill's author ('starchild') and is essential for the skill's primary function of providing paid on-chain intelligence.
[INDIRECT_PROMPT_INJECTION]: As a tool that ingests external data from Nansen, the skill possesses an attack surface where maliciously crafted on-chain data could attempt to influence the agent's behavior. However, the risk is minimized by the skill's narrow scope and explicit instructions to never fabricate responses.

@1365/xfree02