The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the official installation script for the Cartridge Controller CLI.
Evidence: The SKILL.md file contains instructions to download the installer from https://raw.githubusercontent.com/cartridge-gg/controller-cli/main/install.sh.
[REMOTE_CODE_EXECUTION]: The skill instructs the user/agent to execute a remote script via pipe to bash, which is the official installation method for the vendor tool.
Evidence: curl -fsSL https://raw.githubusercontent.com/cartridge-gg/controller-cli/main/install.sh | bash in SKILL.md.
[COMMAND_EXECUTION]: The controller_safe.py script executes the controller binary using system calls.
Evidence: Uses subprocess.run(["controller", subcmd, *args], ...) which safely handles arguments as a list, preventing shell injection.
[PROMPT_INJECTION]: The skill processes blockchain data and CLI outputs that could theoretically contain indirect instructions.
Ingestion points: scripts/controller_safe.py ingests and parses the stdout of the controller CLI tool.
Boundary markers: The skill enforces --json to ensure structured data parsing, though it does not use explicit NL delimiters.
Capability inventory: The skill has the capability to execute shell commands (Bash) and initiate blockchain transactions.
Sanitization: The script scripts/controller_safe.py validates that output is valid JSON and checks for specific error_code fields before proceeding. The scripts/validate_hex_address.py script ensures contract addresses follow a strict hex format.

controller-cli