The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to handle webhooks and payment notifications from external gateways (SePay and Polar). This creates a potential surface where malicious instructions could be embedded in transaction metadata, descriptions, or customer-provided fields (like 'content' in bank transfers).
Ingestion points: Webhook verification handlers described in references/sepay/webhooks.md and references/polar/webhooks.md, as well as the script entry points scripts/sepay-webhook-verify.js and scripts/polar-webhook-verify.js.
Boundary markers: The documentation emphasizes strict signature verification for Polar webhooks and API Key/OAuth2 authentication for SePay to ensure authenticity, though these do not inherently sanitize the content of the data payload.
Capability inventory: The skill guides the agent to perform database updates (marking orders as paid), network operations (API calls for fulfillment), and automated benefit delivery (GitHub access, Discord roles).
Sanitization: Implementation patterns include code for signature validation and data checking, though specific sanitization of natural language fields is not explicitly detailed.
[EXTERNAL_DOWNLOADS]: The skill's documentation and guides reference several external packages and libraries required for the integration.
Node.js: Fetches the SePay SDK directly from a GitHub repository (github:sepay/sepay-pg-node) and the official Polar SDK via NPM (@polar-sh/sdk).
PHP: Downloads the SePay and Polar SDKs via Composer (sepay/sepay-pg, sepayvn/laravel-sepay, polar-sh/sdk).
Python: Installs the official Polar SDK via PyPI (polar-sdk).
Go: Fetches the official Polar Go client (github.com/polarsource/polar-go).
These downloads target the official repositories of the payment providers (SePay and Polar) and are documented neutrally as part of the setup instructions.

payment-integration