The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires users to add a remote MCP server hosted at https://rube.app/mcp. This creates a dependency on an external, third-party service to facilitate all Square operations.
[DATA_EXFILTRATION]: Because the Rube MCP server acts as an intermediary, sensitive business data from Square—including payment details, customer orders, and invoices—is transmitted to and processed by the rube.app domain.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it retrieves and processes untrusted data from Square.
Ingestion points: Tools like SQUARE_LIST_PAYMENTS, SQUARE_SEARCH_ORDERS, and SQUARE_LIST_INVOICES fetch data from the Square API which may contain attacker-controlled content in fields like notes or descriptions.
Boundary markers: There are no instructions or delimiters provided to the agent to distinguish between valid data and potentially malicious instructions embedded within the retrieved Square objects.
Capability inventory: The agent has significant capabilities, including SQUARE_UPDATE_ORDER, SQUARE_CANCEL_PAYMENT, and SQUARE_CANCEL_INVOICE, which could be abused if an injection is successful.
Sanitization: The instructions do not specify any validation or sanitization of the data retrieved from Square before it is used to inform further agent actions.

square-automation