The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to install official Adobe libraries and CLI plugins.
Evidence:
Installation of @adobe/aio-lib-db from the standard registry.
Installation of the @adobe/aio-cli-plugin-app-storage plugin from the official Adobe repository (github.com/adobe/aio-cli-plugin-app-storage).
These are trusted resources belonging to the skill's authoring organization (Adobe).
[COMMAND_EXECUTION]: The skill uses standard development commands and Adobe-specific CLI tools to initialize and provision the project environment.
Evidence:
Execution of npx @adobe/aio-commerce-lib-app init to scaffold the project structure.
Use of aio app db provision to set up workspace storage.
These commands are routine for Adobe Commerce app development and operate within the project's development context.
[INDIRECT_PROMPT_INJECTION]: The skill describes a workflow where the agent ingests user intent to generate functional code, which is a common surface for indirect instructions.
Ingestion points: The agent gathers 'Action type', 'Collection name', and 'Operations' from the user in Step 3 of SKILL.md.
Boundary markers: The skill provides strict structural requirements for registration (e.g., include-ims-credentials: true) and code implementation (init -> connect -> close) which serve as behavioral constraints for the generated output.
Capability inventory: The generated code performs database operations (read/write) using authenticated sessions and handles runtime actions through the aio-lib-db client.
Sanitization: The instructions include specific guidance on handling input safely, such as properly converting string IDs to ObjectId using the bson library and using projections to limit data exposure.
[SAFE]: The skill follows security best practices for secret management and resource lifecycle.
Evidence:
Instructions mandate using finally blocks to ensure database connections are closed, preventing resource exhaustion.
Authentication relies on platform-injected IMS credentials (AIO_COMMERCE_AUTH_IMS_*) rather than hardcoded secrets or unsafe credential storage.

commerce-app-storage