The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill facilitates the creation and execution of custom modules containing HTML, CSS, and JavaScript. These modules are "upserted" into the cart profile via the lexsis_drafts.cart_edit tool. While the skill documentation mentions compiler restrictions (e.g., blocking window and document access) and scoping, the capability to inject and run authored scripts at runtime is a significant security surface.
Evidence: Documented in SKILL.md (Workflow step 5) and detailed in references/module-authoring.md.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data including Shopify product catalogs, customer metadata, and reward configurations. This data is interpolated into custom modules and visibility rules (e.g., visible_when clauses). Although the skill specifies the use of boundary markers and sanitization for CSS and script escapes, the ingestion of external data combined with the ability to write to live storefront configurations creates an attack surface for indirect prompt injection.
Ingestion points: lexsis_cart.get (fetching effective profile and history), Shopify catalog IDs, and customer metadata accessed via host session providers.
Boundary markers: Explicit instructions in SKILL.md to use scoped CSS and the rejection of remote URLs and script escapes.
Capability inventory: lexsis_drafts.cart_edit (draft modification), lexsis_live_ops.cart_publish (publication of configurations), and managed cart commands (lx:cart:*) for cart mutations.
Sanitization: Compiler-enforced restrictions on global object access (window, document) and automated sanitization and scoping of custom CSS at render time.

cart