The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill implements strong secret management guidelines. It explicitly forbids the agent from requesting API keys or callback secrets in plaintext within the chat, directing users to utilize .env files or secure secret managers. It also mandates verifying that sensitive files are excluded from version control via .gitignore.
[EXTERNAL_DOWNLOADS]: The skill performs a non-blocking version check by sending its current version to the vendor's API (portaly.ai). This telemetry is used for update notifications and does not transmit sensitive project information or user data. This is documented as a standard vendor feature.
[DYNAMIC_EXECUTION]: Local utility scripts (Node.js, Python, and Go) are provided to verify HMAC-SHA256 signatures for payment callbacks. These scripts ensure the integrity of incoming payment data and are used for functional verification of the security protocol rather than executing untrusted remote code.
[COMMAND_EXECUTION]: The included test suite (check_callback_vectors.mjs) uses node:child_process to execute the local Python and Go signature verification scripts. This is used to ensure cross-language compatibility of the payment security layer during development.
[INDIRECT_PROMPT_INJECTION]: The skill processes data from payment callbacks and API responses, including custom metadata. These ingestion points are secured by mandatory cryptographic signature verification and server-side sanitization of rich text content (e.g., plan descriptions), mitigating the risk of malicious data influencing agent behavior.

portaly-payment