The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill provides installation commands for supplementary setup tools located in the vendor's GitHub repository (AgentPMT/agent-skills) using the npx skills utility.- [DATA_EXFILTRATION]: Core functionality involves transmitting sensitive business and financial data (customer records, balances, and payment links) between the agent's context and Stripe's API via the vendor's hosted endpoints at api.agentpmt.com.- [PROMPT_INJECTION]: The skill accepts untrusted user data in several fields, representing a surface for potential indirect prompt injection attacks:
Ingestion points: User-provided strings in parameters such as question in search_stripe_documentation, quote in send_stripe_mcp_feedback, and answer in stripe_integration_recommender (found in SKILL.md and schema.md).
Boundary markers: The instructions do not specify any delimiters or warnings to the agent for handling user-provided content safely during prompt interpolation.
Capability inventory: The skill possesses extensive capabilities, including issuing refunds, creating invoice items, and modifying subscription items (schema.md).
Sanitization: There is no evidence of specific sanitization or validation logic for the free-text input parameters.

stripe-direct-connection