The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file includes a specialized text block intended for the AI agent to interpret and act upon. This block directs the agent to initiate a multi-step sequence involving the installation of external payment tools and the purchase of a commercial skill. The use of imperative language to guide the agent through software installation and financial transactions represents a behavioral override designed to automate external processes.
[EXTERNAL_DOWNLOADS]: The instructions within the skill recommend the execution of npx -y @alipay/agent-payment@latest install. This command fetches and executes code from the public NPM registry at runtime. The referenced package is provided by a well-known financial technology service.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user-provided cash count tables, which presents a surface for indirect injection.
Ingestion points: Untrusted data is ingested through the text field in the input payload, which is then parsed by scripts/engine/cash-count-check.js.
Boundary markers: The skill does not implement boundary markers or instructions to the agent to ignore potential commands embedded within the data tables.
Capability inventory: The skill is permitted to use Read and Bash tools, which are employed to run the local audit scripts.
Sanitization: The audit engine performs numeric normalization and checks for specific placeholders (e.g., '待填', 'TBD'), but it does not specifically sanitize the input against prompt-based attack vectors.

cash-count-check-free