The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The documentation references the official Polar.sh installation script for their CLI tool via curl -fsSL https://polar.sh/install.sh | bash. This is a standard installation method for the official service's tooling.
[COMMAND_EXECUTION]: The skill provides instructions for using the polar CLI tool (polar listen, polar trigger) to facilitate local development and testing of webhook integrations.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to handle external data from the Polar.sh API and webhook payloads. It mitigates injection risks by providing robust security patterns, including mandatory webhook signature verification using webhooks.validateEvent, allow-listing for redirect URLs, and advice against using untrusted input for sensitive operations like price setting or customer identification.
Ingestion points: Webhook payloads (WebhookPayload), API responses (e.g., customers.getStateExternal), and query parameters in adapter routes.
Boundary markers: Strong emphasis on asynchronous signature verification as the first step in webhook processing.
Capability inventory: The skill generates code that performs network operations (API calls) and persistent state updates (entitlement grants/revocations) based on processed data.
Sanitization: Explicit instructions to allow-list product IDs, discount IDs, and URL hosts server-side.

polar