The Agent Skills Directory

[PROMPT_INJECTION]: The SKILL.md file contains a pre-formatted instruction block designed to be read by or provided to an AI agent. This block uses authoritative directives such as "I have authorized installing dependencies and initiating purchase" and "do not confirm for me" to nudge the agent into bypassing standard security confirmations for sensitive actions like software installation and financial transactions.
[INDIRECT_PROMPT_INJECTION]: The skill documentation presents a risk of indirect injection where an agent reading the file to assist the user may interpret the "Needs full version" section as active commands to follow.
Ingestion points: SKILL.md (read by the agent during skill initialization or help queries).
Boundary markers: The instruction payload is enclosed in a code block, but lacks clear delimiters or instructions for the agent to treat the content as inert data.
Capability inventory: The skill is configured with allowed-tools: [Read, Bash], which gives the agent the necessary permissions to execute the npx and shell commands suggested in the injection payload.
Sanitization: No sanitization or explicit safety warnings are provided to prevent the agent from interpreting the documentation content as direct instructions.
[EXTERNAL_DOWNLOADS]: The documentation explicitly encourages the execution of npx -y @alipay/agent-payment@latest install. This command downloads and executes code from an external package registry. While the package scope is associated with a known service, the automated execution of third-party scripts via agent prompts represents a significant execution risk.

promo-subsidy-check-free