The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data through Stripe webhooks, representing an attack surface for indirect prompt injection.\n
Ingestion points: app/api/webhooks/stripe/route.ts (extracts raw request body and headers).\n
Boundary markers: Implements mandatory cryptographic signature verification via stripe.webhooks.constructEvent to ensure authenticity.\n
Capability inventory: The logic performs database writes (upsert/update/create) using Prisma and executes email sending functions (sendPaymentFailedEmail).\n
Sanitization: Uses the official Stripe SDK to parse and validate incoming event objects, reducing the risk of processing malformed or malicious payloads.\n- [SAFE]: The skill follows established secure coding practices for revenue operations and payment processing.\n
Credential management: Code examples correctly utilize environment variables (process.env.STRIPE_SECRET_KEY) rather than hardcoding sensitive keys.\n
PCI Compliance: Instructions correctly prioritize Stripe Checkout and hosted solutions to prevent sensitive credit card data from touching the application's server environment.\n
Idempotency: The skill includes robust event deduplication by checking the stripeEventId against a processedEvent database table before execution.

agent-payment-billing-specialist