The Agent Skills Directory

[SAFE]: The skill serves a legitimate and security-conscious purpose of generating payment integration code based on pre-defined fragments and recipes.
[SAFE]: It implements a robust security framework (Rules 1-28) within its generation logic, ensuring that the emitted code handles webhooks, idempotency, and PII with high standards. For example, it enforces the use of timingSafeEqual for signature comparisons and implements strict body size limits.
[SAFE]: No hardcoded credentials or malicious URLs were found. The skill correctly uses environment variables and provides .env.example files with test-mode placeholders only.
[INDIRECT_PROMPT_INJECTION]: The skill ingests provider configuration data (providers/<provider>.json) and recipes (recipes/default.json). While this is a data ingestion surface, the skill is designed to treat these as structured data for text generation and does not have the capability to execute instructions contained within them.
[NO_CODE]: The skill folder contains markdown instructions and code templates for the AI to use as output, but it does not ship with any executable code that runs as part of the skill's own operation.

integration-builder