The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to retrieve and summarize data from SumUp APIs, which introduces a potential surface for indirect prompt injection if malicious content is embedded in merchant records.
Ingestion points: Transaction summaries, merchant profile data, and checkout status transitions (SKILL.md).
Boundary markers: The suggested prompt patterns do not incorporate delimiters or specific instructions to isolate and ignore instructions found within API data.
Capability inventory: The integration provides tools to read merchant information and manage checkouts.
Sanitization: There are no instructions for the agent to sanitize or validate the content retrieved from external sources before processing.
[EXTERNAL_DOWNLOADS]: The skill directs users to install external tools and plugins from vendor-controlled sources.
Evidence: Instructions for installing sumup/sumup-skills via the Codex marketplace and the @sumup/mcp package via Node.js.
[REMOTE_CODE_EXECUTION]: The skill includes instructions to execute a package directly from the network.
Evidence: The command npx -y @sumup/mcp downloads and runs the latest version of the SumUp MCP server code.

sumup-mcp