The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill utilizes local utility scripts to fetch up-to-date documentation and API specifications from the official vendor domain.
Evidence: scripts/docs-search.mjs, scripts/graphql-schemata.mjs, and scripts/openApi-schemata.mjs connect to docs.commercetools.com.
[DATA_EXFILTRATION]: Telemetry data is collected and transmitted to the vendor's analytics endpoint to facilitate usage tracking.
Evidence: Instrumentation logic in the scripts reads the domain part of the user's git email and project configuration, sending it to official commercetools endpoints. This behavior includes an opt-out mechanism via environment variables.
[INDIRECT_PROMPT_INJECTION]: The skill implements a feature to ingest documentation into the agent context, creating a standard vulnerability surface for indirect injection.
Ingestion points: Results from docs-search.mjs are printed directly to the agent's context.
Boundary markers: No specific delimiters are used to separate external content from instructions.
Capability inventory: The skill permits script execution and file system operations within the development environment.
Sanitization: Content is fetched from verified vendor domains but is not filtered for potential malicious instructions.

commercetools-storefront