The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill documents how to handle external webhooks and browser redirects, which serve as ingestion points for untrusted data from third-party payment providers.
Ingestion points: Handlers handleAcquirerWebhook and callbackHandler process data from external request bodies and query parameters.
Boundary markers: The skill provides logic to map variable external statuses into a fixed set of approved internal values.
Capability inventory: The logic utilizes fetch for network notifications and vbase for transaction storage.
Sanitization: The instructions require preserving the X-VTEX-signature query parameter for cryptographic validation of the callback source.
[DATA_EXFILTRATION]: The skill implements network operations to communicate payment status updates to the platform. These requests target legitimate platform-owned domains and use authenticated headers derived from environment variables rather than hardcoded secrets.
[EXTERNAL_DOWNLOADS]: The skill identifies a dependency on the @vtex/payment-provider package, which is a verified platform library from a known organization.

payment-async-flow