The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes data from several untrusted or external sources to drive billing configurations.
Ingestion points: Data is ingested from the Stripe model catalog (https://llm.stripe.com/v1/models), the user's application source code, and user-supplied pricing artifacts (URLs, screenshots, or documents).
Boundary markers: The skill establishes a human-in-the-loop boundary by requiring the agent to present inferred terms for correction and obtain explicit user confirmation of the "Business model" and "Models" summary before any write operations occur.
Capability inventory: The agent has the capability to write to the Metronome and Stripe APIs, read from the local filesystem (codebase research), and write a persistent run report to the local disk.
Sanitization: The instructions include a requirement to sanitize feedback before submission to Stripe, though no explicit technical sanitization is defined for the external API inputs beyond normalization of model names.
[DATA_EXPOSURE]: The skill creates a persistent "run report" at /tmp/metronome-token-billing-report.md. While the instructions explicitly state to keep secrets out of the report, it contains detailed information about inferred decisions, approved plans, and infrastructure operations. On multi-user systems, this file may be world-readable, potentially exposing internal business logic or configuration details to other local users or processes.
[EXTERNAL_DOWNLOADS]: The skill fetches pricing and model configuration data from Stripe's official model catalog endpoint (https://llm.stripe.com/v1/models). This is an expected operation for the skill's primary purpose.
[COMMAND_EXECUTION]: The skill performs automated research into the application repository to identify frameworks, identity models, and API client usage. This involves extensive reading of local files to guide the integration setup.

metronome-token-billing