The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill requests a 'Campaign Cart API key' from the user and writes it directly to config.js and campaigns.json files as plain text. This behavior is documented in the README, which advises users to review these files before sharing or pushing the project to public repositories.
[EXTERNAL_DOWNLOADS]: The skill retrieves starter templates from the vendor's GitHub repository (NextCommerceCo/campaign-cart-starter-templates) and installs the next-campaign-page-kit package from the npm registry.
[COMMAND_EXECUTION]: The skill uses Bash to execute npm init, npm install, and npx campaign-init for project scaffolding and initialization.
[INDIRECT_PROMPT_INJECTION]: The skill can ingest data from a CampaignSpec to pre-populate configuration fields such as store names, slugs, and tracking IDs.
Ingestion points: External CampaignSpec data (referenced in Step 8 of SKILL.md).
Boundary markers: Not explicitly utilized for data interpolation.
Capability inventory: File system modifications (Write, Edit) and shell command execution (Bash) across the setup process.
Sanitization: Includes validation of provided URLs to ensure they use the HTTPS protocol and follow standard domain formats (Step 8).

next-campaigns-setup