The Agent Skills Directory

[SAFE]: The skill utilizes the vendor's official SDK (dodopayments) for all API interactions, ensuring standardized and secure communication with the payment platform.
[SAFE]: Sensitive credentials like API keys are handled correctly using environment variables (process.env.DODO_PAYMENTS_API_KEY) rather than being hardcoded.
[INDIRECT_PROMPT_INJECTION]: The skill includes instructions for handling external data received via webhooks in references/webhook-events.md.
Ingestion points: The POST handler accepts raw HTTP request bodies from the Dodo Payments service.
Boundary markers: The implementation utilizes client.webhooks.unwrap to verify the cryptographic signature of the payload, ensuring the data originates from a trusted source.
Capability inventory: The ingested data is used to trigger business logic (e.g., grantAccess, notifyPaymentFailed) within a controlled database environment. No dangerous capabilities such as shell execution or dynamic code evaluation are exposed to the webhook payload.
Sanitization: The skill verifies the authenticity of the data and uses structured parsing, which prevents common injection attacks through external data streams.

subscription-integration