The Agent Skills Directory

[SAFE]: The skill serves as an instructional guide for interacting with the Spree Commerce payment system, covering state machines, payment methods, and sessions.
[CREDENTIALS_SAFE]: While the skill discusses the storage of gateway credentials (like Stripe API keys), it correctly recommends using environment variables (ENV['STRIPE_SECRET_KEY']) in code snippets. Furthermore, it provides a valuable security warning by noting that the platform itself persists these values in plain text in the database.
[COMMAND_EXECUTION]: The CLI commands provided (such as spree bundle add, spree migrate, and spree dev) are standard administrative operations for the Spree ecosystem and do not involve suspicious or unauthorized execution patterns.
[EXTERNAL_DOWNLOADS]: References to external code repositories, such as the Stripe integration gem on GitHub, point directly to the official vendor organization and are used for documentation purposes.
[INDIRECT_PROMPT_INJECTION]: The skill documents the attack surface for payment sessions and webhook handling. It provides a standard architectural overview without introducing vulnerabilities or bypassing safety constraints.

spree-payments