The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill facilitates the storage of private keys and session tokens in plaintext JSON files (e.g., ~/.config/fibx/session.json or ~/Library/Preferences/fibx-nodejs/session.json). Plaintext storage of cryptographic private keys is a high-risk practice as it allows any process or user with file system access to compromise the wallet.
[REMOTE_CODE_EXECUTION]: The skill uses npx fibx@latest to execute CLI commands. This pattern fetches and executes the most recent version of the fibx package from the public npm registry at runtime. Running unversioned remote code without integrity checks (like hashes) exposes the user to supply chain attacks if the package or registry is compromised.
[COMMAND_EXECUTION]: The skill executes shell commands with user-supplied parameters (email, code) without explicit instructions for sanitization or escaping. The allowed-tools configuration uses wildcards (e.g., Bash(npx fibx@latest auth login *)), which may allow an attacker to perform command injection by providing malicious input that includes shell metacharacters.
[EXTERNAL_DOWNLOADS]: The skill initiates downloads of the fibx package from the npm registry via npx during execution.

authenticate-wallet