The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill provisions and manages sensitive twk_ API keys, which are the primary credentials for trading and quoting operations.
Evidence: The skill instructions direct the agent to store these keys in a local configuration file (~/.config/treasures/credentials.json). Although the instructions advise using chmod 600 and caution against logging the keys, managing plaintext secrets in the filesystem represents a sensitive credential handling process.
[DATA_EXFILTRATION]: The skill transmits sensitive API keys and wallet identifiers to external API endpoints for trading operations.
Evidence: All core operations send the X-API-Key to api.treasures.io. This domain does not perfectly match the vendor's provided resource patterns (e.g., treasures-io.io, treasures-io.com), which consistently include a dash in the naming scheme. While logically a primary domain, this discrepancy between the vendor context and the skill implementation is noted as a potential domain mismatch.
[PERSISTENCE]: The skill maintains access across sessions by persisting credentials and wallet metadata locally.
Evidence: It establishes a named profile system in ~/.config/treasures/credentials.json to store the api_key, wallet_id, and associated Sol/EVM addresses.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it processes data retrieved from external API responses.
Ingestion points: API responses from api.treasures.io/api/v1/wallets/:id/balances, onboarding-sessions/poll, and other endpoints are read into the agent's context.
Boundary markers: The onboarding documentation warns developers to strictly parse JSON rather than using string-matching, which helps ensure data integrity but does not fully eliminate injection risks from the source.
Capability inventory: The agent has the capability to write to the local filesystem and perform further authenticated network requests based on data parsed from these APIs.
Sanitization: The skill emphasizes the use of big-decimal arithmetic and atomic integer parsing for amount validation.
[EXTERNAL_DOWNLOADS]: The skill relies on external libraries for its core trading logic.
Evidence: The TypeScript examples provided in the skill use the big.js library for managing decimal precision and atomic token units. The skill assumes this dependency is available in the runtime environment.

treasures-wallet