The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent or user to clone a repository from an external GitHub organization (github.com/agentic-commerce-protocol/agentic-commerce-protocol.git) which is not identified as a trusted source within the context of this skill.
[METADATA_POISONING]: The skill claims to be an open standard maintained by OpenAI and Stripe and provides links to their official domains to support these maintenance claims. If the association between these organizations and the referenced external GitHub repository is not as described, it could lead to misjudgment of the implementation's origin and safety.
[INDIRECT_PROMPT_INJECTION]: The skill defines a protocol for receiving and processing commerce data, which creates a significant entry point for untrusted external instructions to be introduced into the agent's context.
Ingestion points: Data is received through fields such as buyer_info, items, and extensions in the checkout API implementations provided in SKILL.md.
Boundary markers: The implementation examples provided do not include delimiters, escaping, or specific instructions designed to isolate untrusted user data from the agent's core logic.
Capability inventory: The skill includes logic for managing purchase sessions, processing items, and confirming transactions, all of which are sensitive capabilities that could be targeted by malicious data.
Sanitization: The code snippets demonstrate basic structural validation for the presence of fields but lack mechanisms to sanitize or filter potential instructional content from string-based input fields.

agentic-commerce-protocol