The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted financial data (supplier names, amounts) and interpolates these values directly into output report messages without sanitization or protective boundary markers. A malicious input file could contain embedded instructions that might influence the agent when it reads the audit results.
Ingestion points: The scripts/run.mjs entry point reads external data files provided via the --input flag.
Boundary markers: Absent. The audit findings are returned as plain text or JSON containing raw data from the input.
Capability inventory: The skill utilizes Read and Bash tools, providing a high-privilege environment if an injection is successful.
Sanitization: Absent. The engine logic in scripts/engine/ap-aging-plan-check.js performs no filtering of the input strings before including them in output messages.
[PROMPT_INJECTION]: The SKILL.md file contains a 'Need a full version' section with a pre-written prompt for the user to paste to the AI. This prompt includes override markers such as "I have authorized the installation of dependencies and initiated the purchase" and "do not confirm for me," which are designed to bypass standard agent confirmation steps for sensitive actions like package installation and financial transactions.
[REMOTE_CODE_EXECUTION]: The documentation instructs the user to run npx -y @alipay/agent-payment@latest install. This command uses the npx utility to download and execute code from the NPM registry. While the package belongs to a well-known organization (Alipay), the use of unpinned remote packages for installation constitutes a remote code execution vector.

ap-aging-plan-check-free