The Agent Skills Directory

[SAFE]: The skill follows security best practices by recommending the use of environment variables (e.g., process.env.STRIPE_SECRET_KEY) to manage sensitive API keys and secrets for payment providers.
[SAFE]: Network operations are limited to official payment provider APIs (Stripe, Paddle, Lemon Squeezy) and the vendor's official domain (polar.sh).
[SAFE]: The skill includes instructions to verify webhook signatures using the official SDK, preventing unauthorized or spoofed events from triggering application logic.
[SAFE]: External dependencies such as @polar-sh/sdk and stripe are official libraries for the respective services.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data as it fetches customer emails and IDs from external provider APIs (Stripe, Paddle, Lemon Squeezy). This data is used for legitimate migration tasks such as creating new customer records and sending transactional emails, with no evidence of malicious instructions or unsafe data handling. The risk is mitigated by structured data mapping, formal SDKs, and webhook signature verification.

polar-migration