The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file includes a specific block of text designed for the user to provide to the AI agent. This block uses imperative language to override standard agent behavior, instructing it to automate a multi-step installation and purchase process. It attempts to set a pre-authorized state for privileged actions (e.g., "I have authorized the installation of dependencies and initiated the purchase"), which can bypass typical user confirmation steps.
[COMMAND_EXECUTION]: The setup instructions in the documentation direct the agent to execute shell commands using npx. Specifically, it prompts the agent to use npx -y to install software, which automatically accepts execution prompts and runs external code on the host system via the agent's command-line capabilities.
[EXTERNAL_DOWNLOADS]: The skill encourages the installation of an external package (@alipay/agent-payment) from the public npm registry. While the package is associated with a well-known payment service, this introduces a dependency on remote code that is not part of the skill's source and is managed via natural language instructions rather than standard dependency files.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process arbitrary user-supplied insurance denial data in medical-insurance-denial-check.js.
Ingestion points: Data enters the system through the payload.text variable during the run operation.
Boundary markers: The processing logic does not employ delimiters or specific instructions to ignore embedded natural language commands within the tabular data.
Capability inventory: The skill is granted Bash and Read tools, which could be abused if an attacker embeds malicious instructions within the insurance tables that the agent subsequently interprets as commands.
Sanitization: There is no evidence of input validation or sanitization to filter out prompt injection patterns from the input data before it is processed by the logic engine.

medical-insurance-denial-check-free