The Agent Skills Directory

[DATA_EXFILTRATION]: The skill manages highly sensitive information, including API credentials and wallet mnemonics. These are stored locally in ~/.twak/credentials.json and ~/.twak/wallet.json. Analysis shows that HMAC secrets and wallet passwords are delegated to the OS keychain (macOS Keychain, Linux Secret Service, or Windows Credential Manager) to avoid exposure. Network operations are restricted to known vendor endpoints (e.g., naming.trustwallet.com) or arbitrary user-specified URLs for micropayments (x402), which include explicit protections against private/loopback IP addresses to prevent SSRF.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes untrusted data from external sources.
Ingestion points: Data enters the agent context through twak search (token metadata), twak dapps (DeFi Llama descriptions), and twak x402 request (HTTP 402 challenges from arbitrary URLs).
Boundary markers: The instructions do not define specific LLM-level delimiters, but references/x402.md explicitly warns developers to sanitize seller-controlled metadata like extra.name before rendering.
Capability inventory: The skill can execute blockchain transactions (transfers, swaps, ERC-20 approvals, job funding) and perform automated tasks via the watch command.
Sanitization: The tool performs client-side validation on transaction amounts, expiry dates, and slippage tolerances, reducing the risk of a malicious prompt successfully tricking the agent into an unsafe transaction.
[COMMAND_EXECUTION]: The skill relies on the @trustwallet/cli global NPM package. This is a legitimate tool provided by the skill's authoring organization. There are no patterns of executing arbitrary remote code or piping untrusted downloads into a shell.

trust-wallet-cli