The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill provides Python code examples for processing PayPal Instant Payment Notifications (IPN) that ingest untrusted data from external POST requests.
Ingestion points: The handle_ipn function in the Flask implementation directly converts external POST request data (request.form) into a dictionary used for processing.
Boundary markers: No boundary markers or delimiters are present in the examples to isolate data fields (like item_name or payer_email) from potential instructions.
Capability inventory: The skill documentation includes scripts capable of making outbound network calls via the requests library and performing logic based on transaction data.
Sanitization: While the code includes logic to verify the authenticity of the message with PayPal's servers, it does not sanitize individual data fields before they are printed or logged, which could allow an attacker to inject instructions into fields like the item name that may later be processed by an AI agent.
[EXTERNAL_DOWNLOADS]: The skill provides integration examples that reference and download assets from a well-known external service.
Evidence: The JavaScript snippet in SKILL.md loads the PayPal SDK from www.paypal.com.

paypal-integration