The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external QR data and API response fields (e.g., merchant names, remarks) which are untrusted inputs. However, it includes comprehensive safety guidelines requiring the agent to wrap these fields in delimiters (「」) and explicitly forbidding the execution of any instructions contained within them.
Ingestion points: QR code strings via --raw_qr and merchant/order metadata from API responses in payment_skill.py.
Boundary markers: SKILL.md mandates the use of 「」 markers to visually isolate untrusted content and requires the agent to ignore any instruction-like language in display fields.
Capability inventory: File system access for state management, network access for Binance APIs, and clipboard access via subprocess calls.
Sanitization: All API communications use structured JSON, and the CLI outputs are formatted to prevent accidental command or prompt injection.
[COMMAND_EXECUTION]: Uses system utilities (osascript on macOS, xclip on Linux, powershell on Windows) to read images from the clipboard. This behavior is transparently documented and is gated by an instruction requiring the agent to ask for explicit user permission before accessing the clipboard.
[EXTERNAL_DOWNLOADS]: Communicates with the official Binance Pay API (bpay.binanceapi.com) to parse QR codes and process payments. This is a well-known service and the communication is secured using standard HMAC-SHA512 request signing.

payment-assistant