leak-buy

Overview

This skill operates leak buy workflows only:

• Accept a promo URL (/) or download URL (/download).
• Include download-code when required by the seller access mode.
• Pay via x402 flow only when required by the seller access mode.
• Save downloaded file locally.

Safety policy (required)

• Never ask for raw private key text in chat.
• Never create buyer keys from this skill.
• Allow only --buyer-private-key-file .
• Block raw-key argument mode and stdin key mode.
• Never print private key material.
• Never construct shell commands by concatenating raw user input.
• Pass URL/path as quoted argv tokens, never through eval or sh -c.
• Reject URL/key path values with whitespace/control characters.
• Require buyer key path to resolve to an existing readable regular file (non-symlink).

Dependency policy (required)

• Require leak binary on PATH.
• Do not execute npx or dynamic package install at runtime.

Required inputs

• Leak promo or download URL.
• Buyer key file path (required only when payment is required).
• Download code (required only for download-code modes).

Safe command construction (required)

Use this pattern:

PROMO_URL="https://xxxx.trycloudflare.com/"
BUYER_KEY_FILE="./buyer.key"
DOWNLOAD_CODE="friends-only"
bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE" --download-code "$DOWNLOAD_CODE"

Do not use placeholder interpolation like <...> directly in executable shell strings.

Command

bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE"

When download-code is required:

bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --download-code "$DOWNLOAD_CODE" --buyer-private-key-file "$BUYER_KEY_FILE"

Optional output controls

bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE" --out ./downloads/myfile.bin

bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE" --basename myfile

First response template

• Confirm URL type (/ or /download).
• Ask for buyer key file path when payment is required.
• Ask for download code when download-code is required.
• Validate URL/key path safety constraints and run with quoted argv tokens.
• Report saved file path and bytes downloaded.

Troubleshooting

• leak missing:
• install: npm i -g leak-cli
• key mode errors:
• use only --buyer-private-key-file