The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes the prava CLI tool to execute shopping operations, including product search, quoting, and payment processing. All commands are executed within the context of the user's linked agent account.
[EXTERNAL_DOWNLOADS]: Requires the @prava-sdk/cli Node.js package. This is a vendor-owned resource provided by Prava Payments for interacting with their commerce infrastructure.
[PROMPT_INJECTION]: The instructions include multiple 'MANDATORY HARD STOPS' and 'confirmation gates' that prevent the agent from proceeding with a purchase or spending money without an explicit, natural language 'yes' from the user. This effectively mitigates risks of accidental or malicious automated spending.
[DATA_EXFILTRATION]: While the skill handles sensitive payment information such as cryptograms and tokens, these are defined as single-use and short-lived (30-minute expiry). The instructions explicitly forbid the agent from logging or repeating PII, and the CLI infrastructure provides masked address summaries to maintain user privacy.
[CREDENTIALS_UNSAFE]: The skill mentions using a local agent configuration file at ~/.prava/agent.json. This is standard behavior for the Prava CLI to maintain its linked status with the vendor's API and does not represent a credential leak within the skill code itself.

prava-shopping