The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles sensitive blockchain private keys for transaction signing. It explicitly instructs against hardcoding secrets and provides secure alternatives, such as using environment variables or local files with restricted filesystem permissions (e.g., chmod 600 on keys stored in ~/.ethereum/keys/ or ~/.solana/keys/). These practices are consistent with secure wallet management for developer tooling.
[EXTERNAL_DOWNLOADS]: The skill references official resources from the vendor (Circle) and established blockchain ecosystems, including developers.circle.com, faucet.circle.com, faucet.solana.com, and the viem.sh documentation. It also links to the vendor's own repositories on GitHub (circlefin/stablecoin-evm). These are trusted sources relevant to the skill's purpose.
[INDIRECT_PROMPT_INJECTION]: The implementation guides in references/evm.md and references/solana.md include functionality to fetch blockchain event logs and transaction signatures to verify incoming transfers. While this constitutes an ingestion surface for untrusted external data, the current implementation strictly logs the metadata (amounts, addresses, and hashes) for informational purposes and does not process the data in a way that could lead to command execution or instruction overriding.
[COMMAND_EXECUTION]: The skill documents standard setup commands for package installation (npm install) and secure file creation. All write operations (sending USDC or approving contracts) are governed by strict security rules that mandate explicit user confirmation before execution, preventing autonomous unauthorized transactions.

use-usdc