The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes scripts that fetch documentation, GraphQL schemas, and OpenAPI specifications from docs.commercetools.com. This is the vendor's official documentation host and is used to provide accurate implementation context.
[COMMAND_EXECUTION]: The telemetry instrumentation executes git config --get user.email to identify the developer's organization domain. It also performs checks for the presence of the git binary to avoid triggering system install dialogs on macOS.
[DATA_EXFILTRATION]: The skill sends usage metadata to docs.commercetools.com. This telemetry includes random installation and session IDs, the commercetools project key/region (if known), and the domain of the user's email address. The instrumentation is designed to respect the COMMERCETOOLS_AI_PLUGIN_TELEMETRY environment variable and Claude Code's telemetry settings.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it ingests and processes content from an external documentation API.
Ingestion points: scripts/docs-search.mjs fetches content from the docs.commercetools.com search endpoint.
Boundary markers: Instructions in SKILL.md direct the agent to use the retrieved documentation as its primary grounding source.
Capability inventory: The skill can execute shell commands via node:child_process, perform network requests via fetch, and read/write telemetry and configuration files in the user's home (~/.commercetools) and temporary directories.
Sanitization: The documentation search results are formatted into Markdown by the script before being processed by the agent.

commercetools-checkout