The Agent Skills Directory

[Dynamic Execution Surface]: The skill incorporates an analysis delegate that can execute SQL queries via execute_analysis_query and mount a hosted sandbox for code execution using analysis_use_code_execution. While the architecture specifies guardrails such as check_analysis_sql (which limits queries to SELECT statements and removes comments) and various execution timeouts, the ability to run dynamic code or queries is a sensitive capability that requires careful deployment configuration.
[Indirect Prompt Injection Surface]: The merchant agent processes data from potentially untrusted external sources, such as buyer and seller messages, which may contain instructions intended to influence the agent's behavior. The skill defines a specific security model to address this:
Ingestion points: According to SKILL.md, the agent ingests data from product listings, business metrics, and communications between buyers and sellers.
Boundary markers: The architecture utilizes MERCHANT_FENCE to encapsulate tool results and message content, helping the model differentiate between its instructions and the data it processes.
Capability inventory: The skill possesses write capabilities including staging updates to listings, prices, and inventories, as well as the ability to apply these changes and perform data analysis.
Sanitization: Security measures include the check_analysis_sql validator and a robust require_host_approval mechanism that prevents any staged changes from being applied to the live system without verification through a host-controlled interface (e.g., an approval portal or explicit SDK call).

commerce-merchant-operations