The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides Node.js scripts (verify-identity.mjs, submit-pitch.mjs, list-pitches.mjs) that must be executed to interact with the blockchain and the pitch registry.
[CREDENTIALS_UNSAFE]: The skill requires the NET_PRIVATE_KEY environment variable for signing transactions. While necessary for blockchain interaction, this grants the skill access to the agent's sensitive private key.
[PROMPT_INJECTION]: The list-pitches.mjs script decodes and displays untrusted data (project names, descriptions) from an on-chain registry, creating a surface for indirect prompt injection.
Ingestion points: scripts/list-pitches.mjs fetches and decodes pitchData from the IPitchRegistry contract via getPitch and getPitchesByAgent.
Boundary markers: Absent; decoded strings from the blockchain are printed directly to the console without delimiters or instructions to ignore embedded content.
Capability inventory: The agent can execute shell scripts, read local files (e.g., pitch.json), and sign blockchain transactions including USDC transfers and contract calls.
Sanitization: Absent; the skill does not perform validation, filtering, or escaping of retrieved on-chain text before processing or display.

pitch-submit