The Agent Skills Directory

[COMMAND_EXECUTION]: The skill performs several command-line operations to facilitate the payment workflow:\n
It verifies the environment using npm --version and which alipay-bot.\n
It executes local Node.js scripts references/create-cashier-url.js and references/get-fortune-result.js to handle data processing and server communication. Note: the content of references/get-fortune-result.js was not included in the provided files for review.\n
It uses the alipay-bot CLI to trigger payment signals.\n- [EXTERNAL_DOWNLOADS]: The skill ensures required tooling is present by executing npx -y @alipay/agent-payment@latest install. This command downloads and executes a package from the official @alipay organization on the NPM registry, which is the vendor's own infrastructure.\n- [REMOTE_CODE_EXECUTION]: The use of npx to install and run the @alipay/agent-payment package involves fetching and executing code from a remote registry.\n- [INDIRECT_PROMPT_INJECTION]: The skill represents a potential surface for indirect prompt injection because it ingests data from a local server and presents the results to the user.\n
Ingestion points: Data is ingested from http://localhost:3000/pay (payment form) and http://localhost:3000/fortune-result (horoscope content) as described in SKILL.md.\n
Boundary markers: The instructions explicitly direct the agent to only deliver the zodiac_sign and fortune fields exactly as returned by the script, prohibiting the generation of original content.\n
Capability inventory: The skill has the ability to execute shell commands (node, npx, alipay-bot) and perform local network requests.\n
Sanitization: User-provided zodiac signs are validated against a hardcoded whitelist in both the skill instructions and the create-cashier-url.js script.

fortune-prediction-payment