The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains a verbatim text block intended to be passed to an AI assistant. This block includes directives such as "I have authorized installation of dependencies and initiating purchase" and "don't confirm for me," which are specific patterns aimed at overriding an agent's default safety guardrails and human-in-the-loop requirements for sensitive actions like financial transactions and software installation.
[INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing external input (financial worksheets) via the --input argument in scripts/run.mjs. This constitutes a vulnerability surface where untrusted data could contain embedded instructions.
Ingestion points: Data enters the system via fs.readFileSync in scripts/run.mjs and is passed to the engine.
Boundary markers: None are implemented to distinguish data from instructions for the agent processing the output.
Capability inventory: The skill has Read and Bash tools allowed, providing a path for potential downstream exploitation if injection occurs.
Sanitization: There is no sanitization of the input content beyond basic JSON parsing and a 4MB size limit.
[EXTERNAL_DOWNLOADS]: The skill documentation encourages the use of external tools and packages from the alipay.com ecosystem and official registries. While these are recognized services, the skill promotes a dependency on remote software components to fulfill its "buy-out" version requirements.
[REMOTE_CODE_EXECUTION]: The skill instructs the user and agent to execute npx -y @alipay/agent-payment@latest install. This command downloads and executes code from a remote registry. Although originating from a recognized vendor, providing instructions that automate the execution of remote scripts is a significant security consideration for agentic workflows.

installment-rate-check-free