The Agent Skills Directory

[DATA_EXPOSURE]: The skill provides robust guidance on managing sensitive API keys (PORTALY_API_KEY) and callback secrets. It mandates the use of environment variables (.env) and .gitignore to prevent accidental credential leakage. It also includes an explicit guardrail instructing the agent to never ask for keys in chat and to treat any pasted keys as compromised.
[DYNAMIC_EXECUTION]: The provided developer utility scripts/check_callback_vectors.mjs utilizes child_process.spawnSync to run local Python and Go scripts. This is used solely to verify the cross-language implementation of the signature verification logic against established test vectors, which is a standard security testing practice.
[INDIRECT_PROMPT_INJECTION]: The skill recognizes that external plan data may contain merchant-authored HTML (e.g., terms of service). It explicitly instructs the agent to sanitize this content before rendering, demonstrating an awareness of and mitigation for potential cross-site scripting or prompt injection from third-party data.
[REMOTE_CODE_EXECUTION]: While the skill includes discovery features for other vendor-related tools via npx skills add, it explicitly forbids the agent from executing these commands automatically, requiring user consent and manual action.
[EXTERNAL_DOWNLOADS]: The skill reports its version to the author's official domain (portaly.ai) for telemetry and update checks. This behavior is consistent with the vendor's role and does not involve unauthorized data exfiltration.

portaly-payment-integration