The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents how to process untrusted data from external payment providers (webhooks). It correctly instructs the agent to implement cryptographic signature verification using the Stripe SDK (stripe.webhooks.constructEvent) to ensure authenticity. Ingestion point is the /api/webhook endpoint mentioned in the SKILL.md file; sanitization is performed via raw body verification. Capabilities involve internal database fulfillment logic based on verified events.- [CREDENTIALS_UNSAFE]: The instructions explicitly address the risk of exposing secrets, mandating that keys remain server-side and recommending defensive coding (e.g., .trim()) to prevent errors caused by malformed environment variables or trailing newlines.- [COMMAND_EXECUTION]: Mentions use of the official Stripe CLI (stripe listen) for local development and testing in SKILL.md, which is a standard procedure and does not involve arbitrary or malicious command execution.

payments