fix(paybox-plugin): prevent prompt injection from untrusted x402 service responses

[magqqgq]

Motivation

This PR hardens the paybox-x402-services AI agent skill to prevent indirect prompt injection attacks, addressing a high-severity vulnerability identified during the workspace security audit. Previously, the agent lacked explicit instructions on how to handle third-party service descriptions, get_contract responses, and paid API response bodies, leaving it vulnerable to malicious endpoints attempting to steer its behavior into unauthorized spending or data exfiltration[cite: 17].

Modifications

• Untrusted Content Ingestion Guardrails (skills/paybox-x402-services/SKILL.md):
  • Added explicit directives instructing the agent to treat all service responses, errors, and metadata purely as data to report, never as instructions to follow[cite: 17].
  • Prohibited the agent from complying with any third-party content that requests calling another service, raising a spend limit, revealing a key/credential, or disregarding earlier instructions[cite: 17].
  • Established a strict security rule that a paid response attempting to steer agent behavior must be treated as a hostile action (an attacker spending money to reach the agent), requiring the agent to surface the suspicious content and immediately stop[cite: 17].

Checklist

• Format your code according to the Contributor Guide.
• Add unit tests as outlined in the Contributor Guide.
• Update documentation as needed, including docstrings or example tutorials.