The Agent Skills Directory

[SAFE]: The skill generates payment integration plans based on trusted templates. It includes a comprehensive set of 12 internal security rules that address common vulnerabilities in payment flows.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official SDKs from well-known payment providers and utilizes client-side scripts from their official domains (e.g., Stripe, Wompi, Lemon Squeezy). These are recognized as well-known technology services.
[COMMAND_EXECUTION]: The integration plans produced by the skill involve standard development commands such as npm install and database migration tools (prisma, drizzle-kit). These are legitimate and necessary for the skill's primary function of building integrations.
[PROMPT_INJECTION]: The skill manages a surface for indirect prompt injection by processing external data to generate code. Ingestion points: Untrusted data enters via the JSON input schema in SKILL.md (e.g., product names, provider types). Boundary markers: The skill uses structured JSON code fences and markdown headers to delimit generated content. Capability inventory: The skill generates plans for subprocess calls (npm install, prisma migrate) and file-write operations across multiple files like templates/compiled/stripe-nextjs-app-router-one-time.md. Sanitization: All templates enforce strict security rules, including Rule 3 (HMAC validation), Rule 6 (PII logging limits), and Rule 12 (PCI scope management).

integration-builder