The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the viem library from the official NPM registry to perform Ethereum cryptographic operations. This process is preceded by a mandatory confirmation gate using the AskUserQuestion tool to inform the user of the package name, target directory, and installation footprint.
[DYNAMIC_EXECUTION]: To handle EIP-3009 typed-data signing, the skill generates a temporary .mjs script at runtime. This script utilizes the viem library and environment variables for the signing key. The logic for this script is static and fully disclosed in the accompanying reference documentation (references/app-x402-flow.md).
[COMMAND_EXECUTION]: The skill executes various system commands including curl for API communication, openssl for nonce generation, jq for JSON processing, python3 for unit math, and cast for blockchain RPC calls. The implementation includes regex-based validation and shell metacharacter blacklisting for all shell-interpolated variables to prevent command injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from HTTP 402 challenge responses, creating a surface for potential indirect prompt injection.
Ingestion points: HTTP 402 challenge body parsed in SKILL.md (Phase 0).
Boundary markers: The skill defines explicit validation rules and uses jq to extract specific fields rather than passing raw JSON to the model.
Capability inventory: The skill can perform network requests (curl), execute Node.js scripts, and initiate blockchain transactions via cast.
Sanitization: Implements strict regex validation for Ethereum addresses, amounts, and URLs, and rejects any free-text fields containing shell metacharacters (e.g., ;, |, &, $, backticks, or newlines).

pay-with-app