The Agent Skills Directory

[SAFE]: The skill mandates secure handling of the PORTALY_API_KEY by requiring it to be read from environment variables and explicitly forbidding the agent from asking the user to provide it in the chat interface.\n- [SAFE]: It implements a defense against credential theft by hardcoding the version reporting endpoint to the vendor's primary domain (portaly.ai), ensuring that even if a user overrides the PORTALY_API_HOST variable, sensitive tokens are not sent to an untrusted destination.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection via the ps URL parameter. It mitigates this risk by providing specific regex validation logic and instructing that the data be handled via server-set httpOnly cookies to prevent client-side manipulation and self-referral fraud.\n- [COMMAND_EXECUTION]: The skill includes a local utility script scripts/check_promotion_setup.mjs. This script performs read-only preflight checks by querying the Portaly API and is intended to be executed by the developer to verify the environment setup.\n- [SAFE]: Instructions regarding the partner program copy correctly advise against hardcoding payout rules or earnings figures, instead linking to the authoritative vendor dashboard at rewards.portaly.cc to prevent inaccurate financial information from being presented to users.

portaly-affiliate