The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill enables agents to discover and pay for resources from arbitrary external service providers ("sellers"). This creates a potential surface for indirect prompt injection, as the agent is instructed to parse and act upon PaymentRequired objects received from untrusted external URLs. A malicious seller could include instructions within these JSON objects to influence the agent's behavior.
Ingestion points: The agent ingests untrusted data from the PAYMENT-REQUIRED headers and the body of HTTP 402 responses when requesting external resources (documented in SKILL.md and references/exact-payment-flow.md).
Boundary markers: The instructions do not specify boundary markers or explicit warnings for the agent to ignore any natural language instructions that might be embedded within the structured payment data.
Capability inventory: The skill grants the agent the ability to execute shell commands via npx and npm, and provides access to sensitive local files (wallet keypairs) defined in environment variables (documented in references/mcp-and-sdk.md).
Sanitization: No specific sanitization or filtering of the external payment requirements is described in the prompt logic, relying instead on the protocol's normalization rules.
[COMMAND_EXECUTION]: The skill provides instructions for the agent to use command-line tools such as npx, npm, pr402-buy, and forge-cli to build and sign transactions. These are functional requirements for the skill's operation but represent significant capabilities.
[EXTERNAL_DOWNLOADS]: The skill configuration and documentation facilitate the download of several external dependencies and communication with remote facilitator services. These resources, including the ipay.sh facilitator and packages under the @pr402 and @http402 namespaces, are consistent with the vendor's documented infrastructure.

pr402-buyer