The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains a dedicated block of text designed to be interpreted by an AI agent to automate the purchase of a 'full' version. This block uses pre-authorized language such as "I have authorized installation of dependencies and initiated the purchase," which is a tactic used to influence the agent into bypassing or shortening its typical confirmation and safety protocols for sensitive actions like package installation and payment processing.
[EXTERNAL_DOWNLOADS]: The skill provides instructions for the agent to execute npx -y @alipay/agent-payment@latest install. This command fetches and executes code from the npm registry. While the package belongs to a well-known organization (Alipay/Ant Group), executing remote code via prompt-driven instructions remains a noteworthy behavior for security monitoring.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it is designed to ingest and parse untrusted text data (platform settlement statements, promo subsidies, etc.) from users or external files without sufficient sanitization or boundary protection.
Ingestion points: Untrusted data enters the context via the run function in scripts/engine/ecommerce-monthly-selfcheck.js and the input file parameter in scripts/run.mjs.
Boundary markers: The parsing logic (regex-based table identification) lacks explicit markers or instructions to the LLM to ignore embedded commands within the financial records.
Capability inventory: The skill's environment grants access to the Bash tool, which could be exploited if an agent is tricked by malicious instructions hidden in the processed financial data.
Sanitization: The code performs arithmetic normalization (e.g., stripping currency symbols) but does not sanitize the text content for potential injection strings.

ecommerce-monthly-selfcheck-free