The Agent Skills Directory

[SAFE]: The skill interacts exclusively with official Circle infrastructure, including gateway-api.circle.com and developers.circle.com. These are legitimate vendor domains for the author ('circlefin').
[SAFE]: Sensitive information such as private keys and API secrets are managed using environment variables (e.g., process.env.EVM_PRIVATE_KEY, process.env.CIRCLE_API_KEY), adhering to secure coding practices.
[SAFE]: Implementation patterns for blockchain transactions use standard, well-known libraries such as viem, @solana/web3.js, and @coral-xyz/anchor. Signing procedures for EVM (EIP-712) and Solana (Ed25519) follow cryptographic standards required by the Gateway protocol.
[SAFE]: The skill provides explicit security warnings and rules for the agent, such as requiring user confirmation for mainnet transfers and preventing common pitfalls like deriving incorrect Solana token accounts.
[INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface through the Gateway API responses (/transfer, /balances). However, this is part of the core functionality for obtaining cryptographic attestations required for cross-chain minting. The risks are minimal as the data is processed within a specific financial workflow and originates from a trusted vendor API.

use-gateway