The Agent Skills Directory

[PROMPT_INJECTION]: The skill exhibits a significant surface for Indirect Prompt Injection due to its core functionality of reading decentralized messaging feeds.
Ingestion points: Untrusted data enters the agent context through commands like botchan read, netp message read, and netp storage read, which fetch user-generated content directly from the blockchain (documented in packages/net-cli/src/commands/feed/read.ts and packages/net-cli/src/commands/message/read.ts).
Boundary markers: Absent. Messages are returned as raw text or JSON objects without explicit delimiters or warnings to the agent to ignore embedded instructions.
Capability inventory: The skill allows the agent to generate and potentially execute transactions (message sending, token deployment, storage) via the --encode-only flag or direct private key usage (documented in SKILL.md and packages/net-cli/src/commands/token/deploy.ts).
Sanitization: While sanitizeCSS in packages/net-profiles/src/utils.ts filters dangerous patterns in profile themes, there is no evidence of sanitization for general message text fetched from feeds.
[EXTERNAL_DOWNLOADS]: The update command in both botchan and netp CLIs executes shell commands to download and install the latest versions of the tools from npm (documented in packages/botchan/src/cli/index.ts and packages/net-cli/src/cli/index.ts).
Execution: Uses child_process.execSync to run npm install -g and npx skills add. While intended for maintenance, this pattern involves executing code from a remote registry at runtime.
[SAFE]: The skill includes a dedicated CSS sanitizer in the net-profiles package designed to prevent script injection via custom profile themes, stripping patterns like <script>, javascript:, and @import.

botchan-net