The Agent Skills Directory

[DATA_EXFILTRATION]: The get command implementation in ovpay.mjs does not restrict requests to the official API domain. If a full URL starting with http is provided, the script will fetch that URL and automatically include the user's Authorization bearer token in the request headers. This design could be exploited to exfiltrate active session tokens to a malicious server.
[CREDENTIALS_UNSAFE]: The skill processes highly sensitive authentication material, including OVpay login credentials and long-lived refresh tokens. These are accessed from environment variables (OVPAY_REFRESH_TOKEN, OVPAY_EMAIL, OVPAY_PASSWORD) and persisted in a local state file (~/.ovpay/tokens.json). While the skill sets restricted file permissions (0o600) on the state file, the storage of active session tokens on the local filesystem represents a potential security risk.
[COMMAND_EXECUTION]: The skill possesses capabilities that could be misused if the agent is manipulated. The login command performs browser automation using the Playwright framework to navigate the WAF-protected OVpay login portal, which involves launching a headless Chromium browser instance. Additionally, the export command writes data to a user-provided file path using writeFileSync, which could potentially be used to overwrite sensitive local files.
[DYNAMIC_EXECUTION]: The ovpay.mjs script utilizes dynamic import() calls to load the playwright and node:crypto modules at runtime, rather than using static top-level imports.
[EXTERNAL_DOWNLOADS]: To support the login process, the skill instructions require the manual installation of the playwright Node.js package and the associated Chromium browser binaries from the official Playwright project.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted data from an external API. 1. Ingestion points: ovpay.mjs retrieves trip history, card details, and customer profiles from api.ovpay.app. 2. Boundary markers: There are no boundary markers or specific instructions to the agent to ignore embedded content within the retrieved data. 3. Capability inventory: The skill possesses network capabilities (fetch), file system write access (writeFileSync), and browser automation capabilities (playwright), all within ovpay.mjs. 4. Sanitization: No sanitization or filtering is performed on the data retrieved from the API before it is passed to the agent's context.

ovpay