The Agent Skills Directory

CREDENTIALS_UNSAFE (HIGH): The skill explicitly supports using FileKeyStore targeting ~/.near-credentials. This is a standard path for NEAR CLI but contains sensitive, often unencrypted, private keys that an agent could be prompted to leak or misuse.
COMMAND_EXECUTION (HIGH): The Sandbox utility and the deployContract functionality allow for the execution and deployment of arbitrary WASM code. While intended for testing and development, these tools provide a high-privilege execution surface.
DATA_EXFILTRATION (MEDIUM): The skill facilitates the handling of seed phrases and private keys (e.g., via generateSeedPhrase and parseSeedPhrase). An agent could be manipulated via prompt injection to exfiltrate these secrets to an external contract or endpoint.
INDIRECT PROMPT INJECTION (HIGH): The skill ingests untrusted data from blockchain contracts via near.view.
Ingestion points: near.view results, contract event logs, and wallet connection events.
Boundary markers: None identified in the provided documentation or code snippets.
Capability inventory: Full blockchain write access (send tokens, call methods, delete accounts, add/delete keys).
Sanitization: No evidence of sanitization of contract-returned data before it reaches the agent context.
UNVERIFIABLE DEPENDENCIES (MEDIUM): The skill references several external packages such as @hot-labs/near-connect and @near-wallet-selector/core. While these are from known organizations, the skill also dynamically loads contract WASM files from the local filesystem (fs.readFile("./contract.wasm")), which is a risk if the source of the WASM is not verified.

near-kit