The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill implements patterns for processing external, untrusted data which could serve as a potential surface for indirect prompt injection.
Ingestion points: Untrusted data enters the system through API request bodies in src/api/store/loyalty/route.ts and raw event data in order-placed.ts or CustomPaymentProviderService webhooks.
Boundary markers: The documentation explicitly recommends using Zod for schema validation in the 'Best Practices' section to define boundaries and sanitize inputs.
Capability inventory: The skill demonstrates the ability to perform network requests (fetch) and database writes (Service methods) based on the processed inputs.
Sanitization: Input validation using Zod is highlighted as a primary security measure for all external data handlers.
[EXTERNAL_DOWNLOADS]: The skill instructions involve the use of the npx create-medusa-app command, which fetches and executes the official Medusa project scaffolding tool from the public registry.
[COMMAND_EXECUTION]: The documentation includes standard development and operational commands such as npx medusa develop for local server management and npx medusa db:migrate for applying database schema changes.
[DATA_EXFILTRATION]: The skill demonstrates outbound network operations to integrate with external commerce services.
Evidence: The CustomPaymentProviderService uses the fetch API to communicate with https://api.custompay.com/v1/sessions for initiating transactions and processing refunds using environment-based API keys.

medusa-development