The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/detect_gpc.mjs executes local shell commands including gpc --version, gpc auth status, and gpc config get. These commands are used for environment detection and do not incorporate unvalidated user input.
[EXTERNAL_DOWNLOADS]: The scripts/detect_gpc.mjs script utilizes npx gpc --version, which may initiate a download of the gpc package from the official NPM registry if the tool is not already installed locally.
[PROMPT_INJECTION]: The skill exhibits a surface for Indirect Prompt Injection as it processes untrusted data from multiple sources.
Ingestion points: The skill reads data from local JSON files (e.g., subscription.json, product.json), fetches subscription and product lists from the Google Play API, and decodes Pub/Sub notification payloads via the gpc rtdn decode command.
Boundary markers: There are no explicit instructions or delimiters defined in the skill to prevent the agent from following instructions that might be embedded within the processed JSON files or API responses.
Capability inventory: The skill allows the agent to execute a variety of gpc CLI commands that can create, modify, or delete monetization resources in the Google Play Console. The scripts/detect_gpc.mjs file uses execSync for environment checks.
Sanitization: The documentation in references/purchase-verification.md and SKILL.md specifies that the gpc CLI tool includes built-in security features, such as automatic redaction of purchase tokens in output and URL-encoding of API parameters to prevent injection.

gpc-monetization