The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs an update check by fetching a JSON manifest from the author's official GitHub repository (raw.githubusercontent.com/NextCommerceCo/skills). This is a standard version check and is restricted to a single, read-only data file.
[COMMAND_EXECUTION]: The skill relies on a bundled Python engine to perform API interactions and file management. To mitigate risks associated with automated execution, the skill uses a 'plan-then-apply' workflow. All modifications are protected by SHA-256 hash validation (--plan-sha256, --edit-sha256), ensuring that the user has reviewed and approved the exact operation before it is performed.
[CREDENTIALS_UNSAFE]: The skill handles sensitive NEXT Admin API tokens. It prioritizes security by instructing the user to never paste keys into the chat. Instead, it guides the user to store them in a local .env file with restricted permissions (chmod 600) and automatically checks for .gitignore configuration to prevent accidental credential leakage to version control.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data such as product catalogues and campaign lists from the store API. This presents a potential surface for indirect injection. The skill mitigates this by presenting the ingested data in a human-readable plan for verification and enforcing structural validation on all JSON inputs before processing.

next-campaigns-create