The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several CLI tools including git, npm, jq, and the Salesforce sf CLI to orchestrate the build and deployment process. It correctly uses npm ci for deterministic dependency installation.
[EXTERNAL_DOWNLOADS]: The workflow involves cloning a reference implementation repository from a known repository (trailheadapps/commerce-b2b-headless). It includes a security step to strip credentials from the repository URL before displaying it to the user.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes data from external sources (Salesforce organization query results and repository files). However, it mitigates this risk through a comprehensive 'GATE' check in Step 5 that validates local file status using git status before proceeding with build operations, ensuring only intended changes are present.
Ingestion points: Salesforce SOQL query results (WebStore, BuyerGroup, PermissionSetGroup), repository README.md, and Git status output.
Boundary markers: The skill uses structured workflows and explicit confirmation steps rather than delimiters for untrusted content.
Capability inventory: File system writes (Edit), shell command execution (npm, git), and metadata deployment via a delegated skill.
Sanitization: Employs jq for precise field extraction from JSON responses, reducing the risk of processing malicious data payloads.

commerce-react-storefront-create