The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for indirect prompt injection by documenting how to handle external webhook data that could influence agent behavior or data retrieval.
Ingestion points: The /api/plaid-webhook endpoint in SKILL.md processes JSON data from req.body.
Boundary markers: No specific delimiters or validation instructions are provided in the code snippets to isolate untrusted data.
Capability inventory: The skill utilizes tools like plaid_getAuthNumbers to retrieve sensitive financial PII (account and routing numbers).
Sanitization: The implementation snippets do not include explicit validation or sanitization of the incoming webhook payload before using item_id to fetch tokens.
[EXTERNAL_DOWNLOADS]: The skill integrates with the Plaid platform, a well-known financial services provider.
Evidence: The skill references official documentation at https://plaid.com/docs/ and utilizes the standard plaid library for Node.js. These are established resources for the intended financial verification functionality.

plaid-account-verification