The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses subprocess.run to interact with platform-specific clipboard tools (macOS osascript, Linux xclip, and Windows powershell) to enable QR code decoding from the clipboard.
Evidence: Found in payment_skill.py within the QRCodeHandler class.
These commands use fixed local paths for image processing and are only executed following explicit user consent as dictated in the SKILL.md safety rules.
[DATA_EXPOSURE]: The skill requires Binance API credentials for operation. It utilizes a standard and secure pattern by instructing users to store these secrets in a local config.json or environment variables.
Evidence: Documented in the Setup Guide and implemented in the load_config function in payment_skill.py.
[PROMPT_INJECTION]: The skill explicitly mitigates Indirect Prompt Injection risks by providing clear instructions to the AI agent to ignore any command-like text found within untrusted data fields such as payee names or transaction remarks.
Evidence: The SKILL.md file contains a 'NEVER DO' section prohibiting the interpretation of API response fields as instructions and requires the use of delimiters (「」) for display.
[EXTERNAL_DOWNLOADS]: All external dependencies listed in requirements.txt (requests, opencv-python, pyzbar, Pillow) are standard, well-known libraries used for networking and image processing.

payment-assistant