The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the twak (Trust Wallet Agent Kit) CLI tool to perform self-broadcasting wallet operations. This is implemented via subprocess.run with a list of arguments, avoiding shell injection risks. Evidence is found in examples/twak/quickstart.py where it executes commands like twak wallet create.
[EXTERNAL_DOWNLOADS]: The skill interacts with external services as part of its protocol duties. It fetches deliverable manifests from IPFS gateways (e.g., via Pinata) and performs blockchain news searches using DuckDuckGo. Evidence exists in examples/voter/watch.py and examples/agent-server/src/service.py.
[CREDENTIALS_UNSAFE]: The skill manages highly sensitive blockchain private keys. It emphasizes secure handling in its documentation (references/sdk-readme.md), instructing users to use encrypted keystores rather than hardcoded keys. Example scripts use standard placeholders (e.g., PRIVATE_KEY=0x...) in configuration templates for developer guidance.
[PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes job descriptions from the blockchain to drive agent actions. Ingestion points: examples/agent-server/src/service.py reads job.get("description"). Boundary markers: Absent. Capability inventory: Shell command execution (twak), network search (ddgs), and blockchain writes (submit_result). Sanitization: Absent. This surface is documented as part of the protocol's optimistic evaluation model.

bnbagent