The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides instructions to install the InFlow CLI by downloading and executing remote scripts directly in a shell. Examples include curl -fsSL https://inflowcli.ai/install.sh | bash and irm https://inflowcli.ai/install.ps1 | iex. While these scripts are hosted on the vendor's domain (inflowcli.ai), the practice of piping unverified remote content to a shell is a high-risk pattern that bypasses local security checks.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to interact with untrusted external resources using the inflow inspect <url> and inflow pay <url> commands. A malicious website could return a payment challenge or metadata designed to manipulate the agent's behavior during the transaction process.
Ingestion points: External URLs provided by users or parsed from content are passed to the CLI for inspection and payment.
Boundary markers: The skill suggests checking for domain matches and price discrepancies, but lacks strict technical delimiters or explicit instructions to ignore instructions embedded within the seller's response.
Capability inventory: The skill possesses the capability to execute shell commands, perform network requests, and write to the local filesystem (e.g., via the --output-file flag).
Sanitization: There is no evidence of sanitization or validation of the data retrieved from the external URL before it is processed by the agent or the CLI.
[COMMAND_EXECUTION]: The skill constructs CLI commands using inputs such as URLs, data payloads, and billing options. If the inflow CLI tool does not internally sanitize these inputs, it could create a vulnerability for command injection when the agent executes these tools via a shell.

agentic-payments