The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The scripts/docs-search.mjs script performs network requests to docs.commercetools.com to retrieve documentation for grounding the agent's responses. This targets the vendor's own infrastructure and is consistent with the skill's purpose.
[DATA_EXFILTRATION]: The skill includes telemetry instrumentation in scripts/docs-search.mjs that sends usage metadata to docs.commercetools.com. Collected data includes installation and invocation IDs, client application and model names, and the domain portion of the user's Git email address. This behavior is disclosed in the script comments and includes an environment-variable based opt-out mechanism.
[COMMAND_EXECUTION]: The scripts/setup.mjs script executes local shell commands to perform its configuration tasks. This includes using git config to retrieve the email domain for telemetry and uv run to execute a local Python script (_bmad/scripts/resolve_customization.py) for validating BMad framework overrides. These operations are limited to the project context.
[INDIRECT_PROMPT_INJECTION]: This skill establishes a development workflow by inserting rules into project templates (e.g., constitution.md, plan-template.md). These rules instruct the agent to load specific commercetools skills when task annotations like [SKILL: <name>] are detected. While this creates a mechanism for directing agent behavior via project data, it is the intended functional design for the spec-driven development framework.

commercetools-spec-driven-development