The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains a pre-written prompt for the user to send to an AI agent, which includes safety-bypass phrases like "我已授权安装依赖" (I have authorized the installation of dependencies). This attempts to override the agent's internal safety guardrails that require user confirmation before executing potentially harmful commands.
[REMOTE_CODE_EXECUTION]: The documentation provides a command "npx -y @alipay/agent-payment@latest install". This pattern downloads and executes arbitrary code from a remote registry at runtime. Although the domain is a well-known payment service, the delivery via an injection-style prompt increases the risk of unauthorized code execution.
[INDIRECT_PROMPT_INJECTION]: The skill lacks protection against instructions embedded in user-supplied data. Ingestion points: Raw text data is ingested through the "text" field in scripts/engine/outsourced-processing-fee-check.js. Boundary markers: The skill does not implement delimiters or safety instructions to prevent the agent from following commands embedded in the table data. Capability inventory: The agent has Bash access and can execute local scripts, providing a target for successful injection. Sanitization: There is no filtering or sanitization of the input text before it is returned to the agent's context.
[COMMAND_EXECUTION]: The skill requires Bash permissions and provides local execution wrappers (node scripts/run.mjs), which allows the agent to execute code on the host environment.
[METADATA_POISONING]: The skill uses deceptive metadata, claiming to be a "Free" tool with "No payment" required, while the actual content is designed to facilitate the purchase and installation of a paid "Buyout version" using automated command instructions.

outsourced-processing-fee-check-free