The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes several Node.js scripts (docs-search.mjs, graphql-schemata.mjs, openApi-schemata.mjs) that perform network requests to docs.commercetools.com. These are used to retrieve the latest documentation and API specifications to provide context for the AI agent.
[COMMAND_EXECUTION]: The provided scripts execute git config --get user.email to extract the organization's domain for telemetry. The skill also recommends the use of official CLI tools such as @commercetools/cli and @commercetools-frontend/mc-scripts.
[DATA_EXFILTRATION]: The scripts transmit limited telemetry data (random installation ID, session ID, and the domain portion of the user's git email) to the vendor's domain (docs.commercetools.com). This behavior is documented in the source code and respects the user's opt-out settings in ~/.claude/settings.json.
[INDIRECT_PROMPT_INJECTION]: The documentation search script introduces a potential surface for indirect prompt injection by ingesting data from an external API.
Ingestion points: docs-search.mjs retrieves documentation from docs.commercetools.com.
Boundary markers: The script uses Markdown headers and separators to structure the results for the agent.
Capability inventory: The skill allows for local script execution and provides guidance for CLI-based resource management.
Sanitization: Content is sourced from the vendor's official documentation service, which is considered a trusted source; however, no secondary sanitization is applied before the content is presented to the agent.
[DATA_EXPOSURE]: Scripts access local configuration files like ~/.claude/settings.json and create state files in ~/.commercetools/ to manage telemetry and installation identity, following standard practices for developer toolchains.

commercetools-connect