The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents a 'dynamic pricing' feature where pricing plans (names, descriptions, features) are stored in a database and managed via an admin panel. This data is then used by the agent to configure or display plan information, creating a surface for untrusted data ingestion.
Ingestion points: Pricing plan metadata (names, descriptions, and feature lists) stored in the database and managed via the /admin/pricing interface.
Boundary markers: No explicit boundary markers or instruction-guarding prompts are specified in the integration guide to isolate this dynamic data.
Capability inventory: The skill documentation references database migration commands (pnpm db:push) and webhook configurations that could be influenced by plan management.
Sanitization: The documentation does not specify any sanitization, validation, or escaping protocols for the content entered into the dynamic pricing admin panel.
[COMMAND_EXECUTION]: The documentation guides the user to execute shell commands for database synchronization (pnpm db:push) and for setting up local developer tunnels using industry-standard tools like cloudflared and ngrok.
[SAFE]: The skill adheres to security best practices for secret management by instructing developers to use environment variables for sensitive credentials (API keys, Merchant IDs, and Private Keys) instead of hardcoding them in the source code. Examples provided in the reference files utilize placeholder strings or truncated certificate headers.
[SAFE]: All external tools, services, and libraries mentioned in the guides (Stripe CLI, Cloudflare Tunnel, ngrok, and the payment providers themselves) are well-known technology services from established organizations.

tinyship-payment