The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides a TypeScript script (mint.ts) that performs on-chain transactions and utilizes a CLI tool (spawnr) to modify local coding tool configurations (e.g., Claude Code, Cursor). These actions involve direct interaction with the blockchain and the local filesystem.
[EXTERNAL_DOWNLOADS]: The skill uses several Node.js packages including viem, dotenv, and agent0-sdk. It also relies on the spawnr CLI tool. All identified external resources and documentation mirrors are hosted on the author's official domain (thespawn.io) or established package registries.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface (Category 8) because it retrieves and processes data from a public registry that could be controlled by third parties.
Ingestion points: Data enters the agent's context through spawnr search results and agent metadata retrieved via spawnr show.
Boundary markers: The instructions explicitly tell the agent to review descriptions and tool lists before hiring, and recommend using the --dry-run flag to preview changes.
Capability inventory: The skill can write to configuration files via spawnr hire and interact with blockchain contracts via the mint.ts script.
Sanitization: There is no automated sanitization of the registry data; mitigation relies on the agent's reasoning and the user's manual review of the dry-run output.
[CREDENTIALS_UNSAFE]: The registration guide instructs users to store their private keys in a .env file. This is a standard and recommended practice for local development and does not constitute a credential leak, as the keys are not exfiltrated.

thespawn