The Agent Skills Directory

[DATA_EXPOSURE]: The skill provides explicit instructions for protecting sensitive data, including using .env.example for secret management, encrypting webhook payloads at rest, and implementing short data retention policies for PII.
[INDIRECT_PROMPT_INJECTION]: The skill addresses the ingestion of untrusted external data (Dodo webhooks).
Ingestion points: Webhook POST endpoint described in references/webhooks.md.
Boundary markers: Uses official SDK signature verification (dodo.webhooks.unwrap) to validate the authenticity of the sender.
Capability inventory: Restricts actions to transactional database updates and background task enqueuing; no shell execution or dynamic evaluation of payload content is present.
Sanitization: Emphasizes strict schema mapping and server-side validation of environment, product, and currency fields.
[COMMAND_EXECUTION]: The skill recommends using the official Dodo CLI for local testing and standard build/lint tools, avoiding any arbitrary command execution or shell injection patterns.
[EXTERNAL_DOWNLOADS]: The skill references the official dodopayments package, which is a well-known service integration, and provides guidance for verifying dependencies against official documentation.

payments-with-dodo