The Agent Skills Directory

[CREDENTIALS_SAFE]: The skill implements strong safeguards for handling sensitive information. It explicitly instructs the agent to never persist actual credential contents, uses placeholders in template files, and automatically updates the project's .gitignore to prevent the accidental exposure of .env files. It also ensures that client IDs are masked when displayed.
[DATA_EXPOSURE]: Network activity is limited to a reachability check against developer.payments.jpmorgan.com. This is a vendor-owned domain used for documentation, and the check is performed via standard HTTPS requests to verify network access before proceeding with the integration.
[INDIRECT_PROMPT_INJECTION]: The skill reads project manifest files (such as package.json or requirements.txt) to identify existing libraries and adapt its generated code to the user's environment. While this constitutes a data ingestion surface, the risk is mitigated by the specific, rule-based logic used to identify known HTTP and JWT libraries, which is a core part of its intended functionality.
[COMMAND_EXECUTION]: The skill includes a local utility script, validate-creds.mjs, which performs cryptographic validation of certificate pairs. This script uses standard, built-in Node.js modules and operates locally on files specified by the user, representing a safe and utility-oriented use of local execution.

jpm-integrations-get-started