The Agent Skills Directory

[COMMAND_EXECUTION]: The script connect-repository-mcp.mjs uses execFileSync to run the git command locally and retrieve the domain of the configured user email. This is used solely for usage telemetry as documented in the source code.
[EXTERNAL_DOWNLOADS]: The skill's scripts (docs-search.mjs and openApi-schemata.mjs) fetch documentation and API schemas from the vendor's official domain at docs.commercetools.com. Additionally, the instructions guide users to run the @commercetools/commerce-mcp package from the npm registry using npx.
[DATA_EXFILTRATION]: The skill implements a telemetry mechanism that sends metadata (such as commercetools project keys, regions, and client types) to docs.commercetools.com. This activity is restricted to the vendor's own infrastructure and includes a documented opt-out mechanism via the COMMERCETOOLS_AI_PLUGIN_TELEMETRY environment variable.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process data from external commercetools APIs and documentation. While this creates an attack surface, the skill's instructions provide comprehensive guidance on mitigating risks through field filtering, response redaction, and least-privilege tool curation.
[PERSISTENCE]: The instrumentation logic maintains a persistent, random installation ID stored in ~/.commercetools/ai-plugin-install-id to identify unique installations for usage analysis.

commercetools-mcp