The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to use curl to fetch asset information from an external API (api.xstocks.fi). These instructions interpolate user-provided symbols into the shell command, creating a potential risk for command injection if the agent does not properly sanitize the input before execution.- [EXTERNAL_DOWNLOADS]: The skill fetches critical asset metadata and contract addresses from an external domain (api.xstocks.fi). This creates a dependency on a third-party source for identifying the correct jetton masters used in financial transactions.- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via the external API response. If the API is compromised, it could provide a fraudulent jetton address that leads the agent to execute a transaction to an attacker-controlled wallet. The skill implements some mitigation by requiring the agent to verify token info and emulate the transaction before requesting user approval. Ingestion points: The JSON response from https://api.xstocks.fi/api/v2/public/assets/{symbol}. Boundary markers: None. Capability inventory: Use of send_raw_transaction to move funds. Sanitization: Verification via get_jetton_info and emulate_transaction.

ton-xstocks