The Agent Skills Directory

[COMMAND_EXECUTION]: The skill interpolates variables derived from the Stripe API and user input (such as $DISPUTE_ID, $CHARGE_ID, and $CUSTOMER_NAME) directly into shell commands like curl and mkdir. Without explicit sanitization, these variables could potentially be used for command injection if they contain shell metacharacters.
[DATA_EXFILTRATION]: The skill is designed to collect sensitive Personally Identifiable Information (PII), usage logs, and billing details from a local database and the Stripe API. While the intended destination is the Stripe API for dispute evidence, the handling and local storage of this aggregated sensitive data in EVIDENCE_DIR represents a significant data exposure surface.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill fetches untrusted content from the application database (e.g., cancel_reason, project names) and the Stripe API.
Boundary markers: There are no boundary markers or instructions to ignore embedded instructions within the fetched data before it is used in prompts or documents.
Capability inventory: The skill possesses capabilities for network access (curl), file system manipulation (mkdir, open), and script execution (node, python).
Sanitization: The instructions suggest quoting content "verbatim" in rebuttals, which lacks protection against malicious payloads or instructions embedded in database fields (e.g., a customer setting their cancel_reason to a prompt injection attack).
[DYNAMIC_EXECUTION]: The skill generates and executes short-lived scripts at runtime, specifically using node -e for Playwright-based PDF generation and Python for WeasyPrint. While these are based on static templates, they process external data (like TERMS_URL) dynamically.
[EXTERNAL_DOWNLOADS]: The skill interacts with external services to download content, including fetching invoice PDFs from Stripe-provided URLs and using a headless browser to capture the TERMS_URL. These interactions are legitimate for the skill's purpose but involve processing external, potentially untrusted web content.

stripe-dispute