The Agent Skills Directory

[PROMPT_INJECTION]: The skill provides a pre-formatted text block for the user to send as a prompt to the AI. This text contains instructions intended to set the AI's authorization state, specifically claiming that the user has already authorized software installation and requesting the AI to bypass certain confirmation steps during a purchase flow.
[REMOTE_CODE_EXECUTION]: The skill's documentation directs the AI to execute the command npx -y @alipay/agent-payment@latest install. This command downloads and runs code from the Alipay organization's official package on the npm registry to facilitate payment processing.
[INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection.
Ingestion points: The skill processes untrusted financial table data provided by users through the scripts/run.mjs script.
Boundary markers: No delimiters or "ignore" instructions are used to isolate user-provided data from the agent's logic during processing.
Capability inventory: The skill has access to Bash and Read tools, which could be leveraged if the agent is misled by instructions embedded in the ingested data.
Sanitization: While the internal engine performs numeric parsing, the final output to the agent includes data derived directly from the untrusted user input.
[METADATA_POISONING]: The skill's summary and descriptions claim it is a "free" tool with "no payment required." However, the content of SKILL.md is significantly focused on upselling a paid version and providing an automated installation and purchase path, which may be deceptive to users expecting a purely free utility.

petty-cash-check-free