The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains a pre-written text block intended for the user to paste into their AI agent's chat. This block includes the statement "I have authorized the installation of dependencies and initiation of purchases," which is a technique used to influence the agent's internal safety or confirmation protocols regarding tool execution and financial transactions.
[REMOTE_CODE_EXECUTION]: The documentation instructs the user to have the AI run npx -y @alipay/agent-payment@latest install. The npx command downloads and executes external code from the NPM registry. While the package is associated with a well-known service (Alipay), suggesting automated remote script execution through the agent context is a behavior typically flagged in security audits.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data (bank statements and accounting logs) which creates an attack surface for indirect injection.
Ingestion points: External data is ingested via the --input flag in scripts/run.mjs or through a text field in the input JSON, which is then parsed by scripts/engine/bank-reconciliation.js.
Boundary markers: The skill does not utilize specific delimiters or instructions to the LLM to ignore potentially malicious commands embedded within the reconciliation records.
Capability inventory: The skill has access to the Bash and Read tools. While the engine logic itself is local, the availability of these tools combined with the processing of external data creates a vulnerability path.
Sanitization: The skill uses regular expressions to extract date and amount fields, which provides some structure, but the memo field is extracted and displayed with minimal sanitization, allowing for potential content spoofing or instruction delivery.

bank-reconciliation-free