@furlpay/agent-skills

FurlPay Agent Skills

Procedural integration knowledge for AI coding agents — Claude Code, Cursor, Codex, Copilot, Windsurf, and any MCP-aware client.

API reference tells an agent what endpoints exist. It does not tell it that the webhook route must be registered before the JSON parser, or that a failed x402 settlement must not release the replay claim. Those are the things that decide whether a generated integration is correct, and they are exactly what gets lost when a developer delegates integration to a model.

These skills encode them.

Skills

Skill	Covers
furlpay-get-started	Package selection, env config, mock vs live, the rules every integration must hold
furlpay-auth	WebAuthn passkeys, rpID across web/native/extension, session cookies, step-up above $3,000
furlpay-payments	Gasless ERC-4337 transfers, Solana Actions, atomic-unit arithmetic, idempotency, record-before-submit
furlpay-wallet	Per-chain address validation, address-to-network binding, Solana ATA derivation, derived balances
furlpay-cards	PAN exclusion and PCI scope, instant freeze, velocity limits, 3DS2 challenge resolution
furlpay-travel	Time-locked escrow, the quote-to-booking identity chain, one-payment-one-booking, MCP tool safety
furlpay-webhooks	HMAC-SHA256 contract, the raw-body requirement, replay protection, safe failure responses
furlpay-x402	The 402 handshake, EIP-3009 off-chain authorization, dual atomic claim, confirmation depth, v1/v2 dialects

Install

Claude Code — add the marketplace, then install:

/plugin marketplace add FurlPay/furlpay-agent-skills
/plugin install furlpay-skills

Any agent — the skills are plain Markdown with YAML frontmatter. Copy the skills/ directory into wherever your tool reads skills from (.agents/skills/, .cursor/rules/, or your own loader). There is no runtime and nothing to execute.

What these are not

They do not execute anything, hold credentials, or make network calls. They are documents. An agent reads one and writes better code; nothing here runs.

They also do not replace the API reference. They cover the parts where a plausible implementation is a wrong one.

Why the content is shaped this way

Each skill leads with the failure mode rather than the happy path, because the happy path is the part a model already guesses correctly. furlpay-webhooks opens with raw bodies because re-serialised JSON breaks HMAC verification and the resulting error — "signature verification failed" — points at the secret instead of the parser, which is where the hour goes.

Every contract stated here was verified against the FurlPay source rather than transcribed from documentation: the 300-second webhook tolerance, the ${t}.${rawBody} signing string, the dual nonce/quote claim, the v1/v2 header split.

Contributing

A skill is wrong if an agent following it produces an integration that fails. If you hit that, open an issue with the prompt and the generated code — that is a more useful bug report than a diff.

MIT.