The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface as it instructs the agent to fetch external documentation from YeePay's official domain (open.yeepay.com) using curl and processes outputs from the YeePay diagnostic API.
Ingestion points: SKILL.md (runtime fetching of doc_md and openapi.json for API specifications) and scripts/diag/ (processing responses from YeePay's remote diagnostic service).
Boundary markers: SKILL.md includes explicit instructions for the agent to treat the fetched documentation as the source of truth for technical fields while adhering to the skill's own interaction disciplines and safety checks.
Capability inventory: The skill possesses network communication capabilities (requests in Python) and local command execution (subprocess for openssl utilities in scripts/sm/crypto.py and scripts/sm/list_platform_certs.py).
Sanitization: The skill implements local sanitization via scripts/diag/redact.py, which identifies and masks PEM blocks, long Base64 strings, and PII (card numbers, IDs) using algorithm-based validation (e.g., Luhn check) before data is transmitted externally.
[CREDENTIALS_UNSAFE]: The skill includes hardcoded private keys in the scripts/rsa/tests/vectors/ and scripts/sm/tests/vectors/ directories. These keys are explicitly labeled as test vectors used only for verifying the correctness of local cryptographic implementations and documentation examples; they are not intended for production use.
[EXTERNAL_DOWNLOADS]: The skill performs network operations to fetch configuration and documentation from YeePay's official domains (open.yeepay.com, sandbox.yeepay.com) and retrieves the latest Java SDK version from Maven Central (central.sonatype.com). These are all well-known and trusted sources associated with the skill's primary purpose.

yeepay-payment-integration