The Agent Skills Directory

[PROMPT_INJECTION]: The skill implements a webhook architecture that ingests data from an external provider (Heleket). This represents a surface for indirect prompt injection, which is mitigated but present.
Ingestion points: POST /api/billing/crypto/webhook (implemented in references/heleket-provider.md).
Boundary markers: Strong signature verification (MD5 with API key) and IP allowlisting are present to authenticate the source.
Capability inventory: The skill performs database updates (via Prisma) and sends user notifications based on external payload content.
Sanitization: The implementation uses strict status mapping and cryptographic validation to ensure payload integrity before processing.
[EXTERNAL_DOWNLOADS]: The skill recommends using cloudflared (a well-known service from Cloudflare) to establish local tunnels for receiving payment webhooks during development. This is a standard and safe practice for testing integrations.
[COMMAND_EXECUTION]: Provides instructions and shell commands for running a Cloudflare tunnel (cloudflared tunnel --url http://localhost:3000) to facilitate local development and end-to-end testing of the payment lifecycle.

crypto-payments