The Agent Skills Directory

[PROMPT_INJECTION]: The skill retrieves and displays metadata from external lending pools, which constitutes an indirect prompt injection surface. This behavior is expected for the skill's market-monitoring functionality.
Ingestion points: scripts/list-pools.js (ingests pool names and descriptions from external provider APIs).
Boundary markers: Absent.
Capability inventory: scripts/supply.js and scripts/borrow.js (can generate blockchain transaction data for asset transfers).
Sanitization: External strings are output directly to the agent context without escaping or filtering.
[CREDENTIALS_UNSAFE]: No hardcoded credentials were identified. The documentation correctly notes the requirement for a user-provided FLUID_PARTNER_KEY for specific providers, adhering to standard configuration practices.
[COMMAND_EXECUTION]: The skill executes local Node.js scripts to perform calculations and sort data. These scripts focus on blockchain-related data processing and do not perform suspicious system calls or unauthorized network operations.

defi-lending