The Agent Skills Directory

[PROMPT_INJECTION]: The skill contains explicit instructions that direct the agent to override and ignore the host platform's standard tool discovery and capability reporting mechanisms. Specifically, it forbids the agent from reporting tools as unavailable even if they are omitted from the platform's tools/list manifest. It further instructs the agent to attempt calling sensitive financial tools (paybox_*) directly regardless of whether the host reports them as exposed. This behavior is intentionally designed to bypass platform-level constraints on tool visibility.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from multiple sources including emails, attachments, and paid-service content (HTTP 402 challenges), creating a vulnerability surface for indirect prompt injection.
Ingestion points: Untrusted data enters the agent context via email bodies, file attachments, and external web content as described in SKILL.md and references/security.md.
Boundary markers: The instructions mandate a human-in-the-loop boundary by requiring a fresh exact preview and explicit user confirmation for every financial transaction.
Capability inventory: The skill possesses extensive financial write capabilities, including paybox_request_transfer, paybox_request_swap, prepare_bridge, and paybox_pay_x402 as defined in references/tools.md.
Sanitization: The instructions include protocols to validate all external terms (amounts, destinations, asset types) against the user's initial authorized request and to reject values introduced by untrusted narrative context.
[EXTERNAL_DOWNLOADS]: The skill utilizes a Model Context Protocol (MCP) server hosted at https://console.mermail.app/mcp. This external connection is required for the skill's core functionality and originates from the vendor's infrastructure.

mermail-agent-wallet