The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Stripe resources, which could theoretically contain malicious instructions designed to influence the agent.
Ingestion points: Data is retrieved from the Stripe API via the stripe call-tool command (manifest.yaml).
Boundary markers: The instructions do not mandate the use of delimiters (like XML tags) to isolate external data from system instructions.
Capability inventory: The skill possesses the ability to modify and delete Stripe data, as well as access balance and invoice information (manifest.yaml).
Sanitization: No explicit sanitization or filtering of API responses is defined in the instructions.
[SAFE]: The skill interacts exclusively with well-known Stripe domains (mcp.stripe.com, access.stripe.com) for its core operations (connector_auth_config.yaml).
[SAFE]: Secure authentication practices are enforced; the instructions explicitly forbid requesting credentials in chat and rely on a per-VM OAuth client managed through a trusted platform service (SKILL.md).

stripe