How do I install the Leak Buy skill?

Run npx skillmds@latest add modbender/leak-buy in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Leak Buy skill do?

Buy and download leak content from promo or download links using a preinstalled leak CLI. It is listed under Coding & Dev Tools on SkillMD.

Is Leak Buy safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts, makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Leak Buy?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Leak Buy free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Leak Buy?

modbender (@modbender) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Leak Buy by modbender — Agent Skill

Name: Leak Buy
Rating: 4.2 (5 reviews)
Author: modbender

File contents

leak-buy

Overview

This skill operates leak buy workflows only:

Accept a promo URL (/) or download URL (/download).
Include download-code when required by the seller access mode.
Pay via x402 flow only when required by the seller access mode.
Save downloaded file locally.

Safety policy (required)

Never ask for raw private key text in chat.
Never create buyer keys from this skill.
Allow only --buyer-private-key-file <path>.
Block raw-key argument mode and stdin key mode.
Never print private key material.
Never construct shell commands by concatenating raw user input.
Pass URL/path as quoted argv tokens, never through eval or sh -c.
Reject URL/key path values with whitespace/control characters.
Require buyer key path to resolve to an existing readable regular file (non-symlink).

Dependency policy (required)

Require leak binary on PATH.
Do not execute npx or dynamic package install at runtime.

Required inputs

Leak promo or download URL.
Buyer key file path (required only when payment is required).
Download code (required only for download-code modes).

Safe command construction (required)

Use this pattern:

PROMO_URL="https://xxxx.trycloudflare.com/"
BUYER_KEY_FILE="./buyer.key"
DOWNLOAD_CODE="friends-only"
bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE" --download-code "$DOWNLOAD_CODE"

Do not use placeholder interpolation like <...> directly in executable shell strings.

Command

bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE"

When download-code is required:

bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --download-code "$DOWNLOAD_CODE" --buyer-private-key-file "$BUYER_KEY_FILE"

Optional output controls

bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE" --out ./downloads/myfile.bin

bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE" --basename myfile

First response template

Confirm URL type (/ or /download).
Ask for buyer key file path when payment is required.
Ask for download code when download-code is required.
Validate URL/key path safety constraints and run with quoted argv tokens.
Report saved file path and bytes downloaded.

Troubleshooting

leak missing:
- install: npm i -g leak-cli
key mode errors:
- use only --buyer-private-key-file <path>

---name: leak-buydescription: Buy and download leak content from promo or download links using a preinstalled leak CLI.--- # leak-buy ## Overview This skill operates `leak buy` workflows only: - Accept a promo URL (`/`) or download URL (`/download`). - Include download-code when required by the seller access mode. - Pay via x402 flow only when required by the seller access mode. - Save downloaded file locally. ## Safety policy (required) 1. Never ask for raw private key text in chat. 2. Never create buyer keys from this skill. 3. Allow only `--buyer-private-key-file <path>`. 4. Block raw-key argument mode and stdin key mode. 5. Never print private key material. 6. Never construct shell commands by concatenating raw user input. 7. Pass URL/path as quoted argv tokens, never through `eval` or `sh -c`. 8. Reject URL/key path values with whitespace/control characters. 9. Require buyer key path to resolve to an existing readable regular file (non-symlink). ## Dependency policy (required) 1. Require `leak` binary on PATH. 2. Do not execute `npx` or dynamic package install at runtime. ## Required inputs 1. Leak promo or download URL. 2. Buyer key file path (required only when payment is required). 3. Download code (required only for download-code modes). ## Safe command construction (required) Use this pattern: ```bash PROMO_URL="https://xxxx.trycloudflare.com/" BUYER_KEY_FILE="./buyer.key" DOWNLOAD_CODE="friends-only" bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE" --download-code "$DOWNLOAD_CODE" ``` Do not use placeholder interpolation like `<...>` directly in executable shell strings. ## Command ```bash bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE" ``` When download-code is required: ```bash bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --download-code "$DOWNLOAD_CODE" --buyer-private-key-file "$BUYER_KEY_FILE" ``` ## Optional output controls ```bash bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE" --out ./downloads/myfile.bin ``` ```bash bash skills/leak-buy/scripts/buy.sh "$PROMO_URL" --buyer-private-key-file "$BUYER_KEY_FILE" --basename myfile ``` ## First response template 1. Confirm URL type (`/` or `/download`). 2. Ask for buyer key file path when payment is required. 3. Ask for download code when download-code is required. 4. Validate URL/key path safety constraints and run with quoted argv tokens. 5. Report saved file path and bytes downloaded. ## Troubleshooting - `leak` missing: - install: `npm i -g leak-cli` - key mode errors: - use only `--buyer-private-key-file <path>`

Frequently asked questions

Leak Buy