The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user input through the $ARGUMENTS variable to determine which sub-functional skill to suggest.
Ingestion points: User input is processed in SKILL.md to match integration keywords like "checkout", "query", or "refund".
Boundary markers: The skill does not use specific delimiters or instructions to ignore potential commands embedded within the user input.
Capability inventory: The skill is primarily instructional and provides routing; it does not possess capabilities for file writing, system command execution, or network requests within its own logic.
Sanitization: No input sanitization or filtering is performed on the provided arguments before the logic branch.
[CREDENTIALS_UNSAFE]: The utility script scripts/encryption.php contains hardcoded strings for HashKey and HashIV in its example usage section.
Evidence: Lines 142-143 in scripts/encryption.php include specific 32-character and 16-character strings. While these correspond to publicly known test credentials from NewebPay's official documentation, hardcoding credentials in code samples can lead to accidental deployment of insecure configurations.

newebpay