The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using curl to interact with the Stripe API for catalog management and subscription updates. While functional, this involves direct manipulation of billing data.
[CREDENTIALS_UNSAFE]: The instructions require the use of $STRIPE_SECRET_KEY in shell commands. While the skill correctly uses environment variables rather than hardcoding values, the presence of these commands exposes highly sensitive credentials to the agent's environment.
[DYNAMIC_EXECUTION]: The skill includes a Python script (psm.py) for Van Westendorp Price Sensitivity Meter analysis. This script is intended to be executed on a local CSV file provided by the user. While the provided code is a standard calculation, executing locally generated or user-provided scripts carries inherent risks if the input data is malicious.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data sources, including survey.csv, sales notes, and sales-assisted deal records. There is a potential attack surface where malicious instructions could be embedded in these untrusted data sources to influence the agent's behavior.
Ingestion points: Data enters the context via csv.DictReader(open(sys.argv[1])) in the Python script and during the manual "Collect the facts" phase where sales notes and buyer alternatives are reviewed.
Boundary markers: None identified. The instructions do not specify delimiters or safety warnings for the agent when reading external customer or survey data.
Capability inventory: The skill uses curl (network/write to Stripe), python3 (subprocess execution), and reads/writes to the local file system.
Sanitization: No explicit sanitization or validation of the survey data or sales notes is provided before processing.

pricing-strategy