The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill integrates with external payment notification callbacks (webhooks) which represent a vulnerability surface for indirect prompt injection.
Ingestion points: Payment notification callbacks processed by the application, specifically the notify_url_address used by the iframe and the notify_url used by the Bit and API V2 integrations (defined in SKILL.md and SKILL_HE.md).
Boundary markers: The instructions explicitly advise developers to verify webhooks using vendor-documented mechanisms such as the 'Hosted Fields Response Hash' or the 'Handshake API V2' flow to ensure data integrity.
Capability inventory: The skill allows the agent to execute a local validation script (scripts/validate_tranzila_response.py) and perform network operations to Tranzila's API endpoints (api.tranzila.com, secure5.tranzila.com).
Sanitization: The skill recommends recomputing response hashes and verifying checksums to sanitize inbound transaction data before processing.
[EXTERNAL_DOWNLOADS]: The skill references the installation of community-maintained software development kits.
Evidence: References to tranzilajs (NPM), futureecom/omnipay-tranzila (PHP), and active_merchant_tranzila (Ruby) are included in the documentation to facilitate integration.
[COMMAND_EXECUTION]: The skill includes a local Python script for developers to use during integration testing.
Evidence: scripts/validate_tranzila_response.py is a standalone utility that parses and validates transaction response strings. It uses standard library functions for JSON and URL parsing and does not perform network operations or access sensitive local files.

tranzila-payment-gateway