The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides commands to download and execute shell scripts directly from a remote server using curl | bash and irm | iex. This allows for arbitrary code execution on the user's system without prior verification of the script content.
Evidence: curl -fsSL https://inflowcli.ai/install.sh | bash in SKILL.md
Evidence: irm https://inflowcli.ai/install.ps1 | iex in SKILL.md
Evidence: curl -fsSL https://inflowcli.ai/cli | bash in SKILL.md
[EXTERNAL_DOWNLOADS]: The skill fetches the inflow CLI and related configurations from external sources, including the domain inflowcli.ai and a Homebrew tap (inflowpayai/tap).
Evidence: brew tap inflowpayai/tap && brew install --cask inflow in SKILL.md
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external URLs and HTTP 402 headers (MPP and x402 protocols). This data is passed to the inflow CLI, which could be exploited if a malicious seller provides specifically crafted payloads designed to influence the agent's behavior.
Ingestion points: inflow inspect <url>, inflow <mpp|x402> decode '<402 header value>' in SKILL.md
Boundary markers: None mentioned for delimiting external inputs.
Capability inventory: Bash(inflow:*), Bash(brew:*), Bash(curl:*) which allow file and network operations.
Sanitization: The skill relies on the CLI's internal parsing and schema validation rather than agent-side sanitization.
[COMMAND_EXECUTION]: The skill relies on executing a local CLI tool (inflow) with arguments often derived from external, untrusted seller inputs, which increases the risk of command injection if the CLI does not handle inputs safely.

agentic-payments