The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches integration guides, API specifications, and SDK documentation from PayerMax's official domains (e.g., docs.payermax.com, cdn.payermax.com). These downloads are used to ensure that generated implementation code and frontend components align with current vendor standards.
[CREDENTIALS_UNSAFE]: Instructions guide the agent to configure sensitive merchant credentials, including RSA private keys, public keys, and application IDs. The skill implements security best practices by directing these values into environment variables (.env) or property files rather than hardcoding them, and explicitly warns against displaying or requesting verification codes.
[PROMPT_INJECTION]: The skill processes user project metadata to tailor its recommendations, which presents an attack surface for indirect prompt injection.
Ingestion points: The agent reads project files such as pom.xml, package.json, go.mod, and source code entry points (SKILL.md).
Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions when reading untrusted project files.
Capability inventory: The skill produces code for network requests (curl), file system writes (config generation), and signing operations.
Sanitization: No specific sanitization logic is provided to filter instructions that might be embedded within the project files being analyzed.
[REMOTE_CODE_EXECUTION]: The skill generates functional integration code and connectivity tests designed to perform outbound API calls to PayerMax gateways. These implementations are constructed dynamically based on API contracts fetched at runtime.
[COMMAND_EXECUTION]: The instructions acknowledge and document the use of platform-specific shell execution syntax (e.g., !git status, !gh pr view) to gather project context. While used for legitimate development tasks, this involves the execution of shell commands within the agent's environment.

payermax-integration-assistant