The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of the sails-pay and @sails-pay/lemonsqueezy packages from the npm registry to provide the payment processing functionality.
[INDIRECT_PROMPT_INJECTION]: The webhook controller in rules/webhooks.md processes external data from Lemon Squeezy HTTP POST requests to update the application's subscription records.
Ingestion points: The api/controllers/webhook/lemonsqueezy.js file reads the raw request body from this.req.body to process incoming payment events.
Boundary markers: The skill implements strong boundary verification using HMAC SHA256 signature validation with the X-Signature header and crypto.timingSafeEqual to ensure the payload originates from the trusted provider.
Capability inventory: The skill uses the Waterline ORM (Subscription.findOne, Subscription.create, Subscription.updateOne) to modify database state based on the validated webhook content.
Sanitization: External data is sanitized through signature verification, and specific fields like the team ID are cast to integers (parseInt), while variant IDs are validated against the local sails.config.pay.plans configuration.

payments