The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided metadata—such as field names, labels, and descriptions—and interpolates them into the app.commerce.config.ts configuration file. This creates an attack surface where maliciously crafted user input could potentially influence the resulting source code or build process.
Ingestion points: User-supplied 'Name', 'Type', 'Label', 'Description', and 'Default value' defined in Step 1 and written to app.commerce.config.ts.
Boundary markers: The skill does not explicitly define boundary markers in the file generation step, relying on agent instructions.
Capability inventory: The skill performs file writes and executes build commands (aio app build).
Sanitization: Step 2 outlines validation constraints for various data types and enforces empty defaults for sensitive password fields to prevent credential exposure.
[COMMAND_EXECUTION]: The skill executes npx @adobe/aio-commerce-lib-app init to initialize project files and aio app build to validate the generated configuration. These commands utilize official Adobe Commerce developer tools.
[DYNAMIC_EXECUTION]: The skill generates TypeScript code for dynamicList fields, which includes factory functions that are executed at runtime to resolve configuration options from external sources.
[EXTERNAL_DOWNLOADS]: The skill uses npx to download and execute the @adobe/aio-commerce-lib-app initialization utility from the official npm registry.

commerce-app-business-config