The Agent Skills Directory

[Command Execution] (MEDIUM): The skill provides scripts/cardano-cli.sh and instructs the user/agent to make it executable and run it (chmod +x). This script acts as an execution wrapper, which contradicts the 'guidance-only' and 'no execution' claims made in the SKILL.md frontmatter and body.
[Unverifiable Dependencies & Remote Code Execution] (MEDIUM): The included shell script pulls and executes a Docker image from ghcr.io/intersectmbo/cardano-node. While IntersectMBO is a legitimate organization in the Cardano ecosystem, it is not on the 'Trusted External Sources' list provided in the security guidelines, making the remote content unverifiable. [TRUST-SCOPE-RULE] does not apply here to downgrade the severity.
[Metadata Poisoning] (MEDIUM): There is a contradiction between the skill's description ('no execution') and its actual content (providing and documenting an execution script). This deceptive metadata can lead to a misjudgment of the skill's security profile.
[Indirect Prompt Injection] (LOW): Command templates in SKILL.md and reference/wallets.md use shell sub-commands like $(cat base.addr) to interpolate file contents into execution strings.
Ingestion points: Contents of base.addr, payment.vkey, and other wallet files are read directly into the shell context.
Boundary markers: No delimiters or warnings are used to prevent the execution of malicious instructions if the file contents are attacker-controlled.
Capability inventory: The skill provides a shell wrapper (cardano-cli.sh) capable of performing file system operations and network queries.
Sanitization: None; the content is passed directly to the shell for evaluation.

cardano-cli-wallets