The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The instructions in SKILL.md encourage the agent to construct an RPC URL containing the ALCHEMY_API_KEY and pass it as a command-line argument to the trace_tx.sh script. This practice exposes the sensitive API key in the system's process table (e.g., visible via ps commands) and potentially in shell history files.
[COMMAND_EXECUTION]: The scripts/trace_tx.sh script performs unsafe string interpolation when building the JSON-RPC payload. Specifically, the TRACER argument is inserted directly into the JSON string without escaping or validation. An attacker providing a malicious tracer string could perform JSON injection to modify the RPC request, potentially invoking different methods or altering parameters.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from external blockchain RPC providers. Malicious instructions could be embedded in on-chain transaction data or revert reasons, which the agent then ingests and interprets when summarizing the trace.
Ingestion points: The RESPONSE variable in scripts/trace_tx.sh which captures the RPC output.
Boundary markers: None identified; the agent is provided with the raw or pretty-printed JSON output.
Capability inventory: The skill can execute shell scripts and write the results to the local filesystem via the -o flag.
Sanitization: None; the script uses standard Python JSON libraries to format the output but does not filter for potential prompt injection patterns.

trace-tx