The Agent Skills Directory

[SAFE]: The skill provides clear instructions and automated mechanisms for secure credential management. Authentication tokens for hosting providers (Vercel, Netlify, Cloudflare) are handled via environment variables instead of command-line flags. The script scripts/lib/redact.mjs explicitly masks sensitive parameters in the onboarding log file, protecting user secrets from exposure in the session history.\n- [COMMAND_EXECUTION]: The skill uses spawn and execFileSync to perform legitimate operations such as application scaffolding (create-mc-app), dependency management (pnpm, npm), version control (git), and deployment (wrangler, vercel, netlify, gh). All user-controllable arguments are sanitized and validated against safe patterns (e.g., slugify for folder names and entry points) to mitigate the risk of command injection.\n- [EXTERNAL_DOWNLOADS]: The skill downloads and executes official commercetools-frontend packages using npx. These tools are necessary for the skill's primary function of scaffolding applications and are pulled from the official NPM registry. These downloads are considered safe as they target well-known vendor infrastructure.\n- [INDIRECT_PROMPT_INJECTION]: The skill features a documentation search capability (docs-search.mjs) that fetches content from docs.commercetools.com. This content is used as context for the AI agent. While processing external data is an ingestion surface, the risk is minimized as the data source is the vendor's own verified documentation platform, which is a standard and expected interaction for development-oriented skills.

commercetools-custom-application