The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external websites and block explorers to generate risk reports. An attacker controlling a protocol's documentation site could theoretically inject malicious instructions to influence the agent's behavior.
Ingestion points: Fetches protocol documentation, audit logs, and security incident reports from user-provided domains using WebFetch (File: SKILL.md).
Boundary markers: No specific delimiters or warnings for the agent to ignore instructions embedded in the fetched content are specified in the workflow.
Capability inventory: The agent can execute shell commands via Bash, write files to disk, and use WebSearch / WebFetch.
Sanitization: No explicit sanitization or filtering of fetched external content before it is processed by the AI is defined in the instructions.
[DYNAMIC_EXECUTION]: The skill uses Python and Node.js one-liners within a shell script to perform EIP-55 checksum calculations on Ethereum addresses. While this involves assembling code at runtime, the risk is mitigated by strict input validation.
Evidence: onchain-check.sh executes small scripts using python3 -c and node -e with user-supplied contract addresses.
Mitigation: The script includes a regular expression check ([[ ! "$raw" =~ ^[0-9a-fA-F]{40}$ ]]) to ensure the input is exactly 40 hex characters before passing it to the interpreters, preventing shell or code injection.

defi-risk-analysis