The Agent Skills Directory

[SAFE]: The skill provides legitimate integration logic for syncing Paddle subscription states. All external references target official Paddle documentation and verified vendor repositories (paddlehq).
[INDIRECT_PROMPT_INJECTION]: The skill defines a data ingestion surface by processing Paddle webhooks. It mitigates injection risks by requiring signature verification (via a prerequisite skill) and utilizing parameterized SQL RPC calls for all database operations.
Ingestion points: The processEvent function in SKILL.md ingests data from EventEntity payloads.
Boundary markers: The documentation explicitly lists the webhooks skill as a prerequisite for signature verification.
Capability inventory: The skill performs database upserts to customers and subscriptions tables using Supabase RPC calls.
Sanitization: Database writes are performed through SQL functions using parameters, preventing SQL injection.
[CREDENTIALS_UNSAFE]: The code snippets utilize standard environment variable patterns (process.env.SUPABASE_SERVICE_ROLE_KEY) for secret management. It correctly advises developers to keep high-privilege service role clients restricted to server-side code to prevent exposure.

paddle-subscription-sync