The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of third-party content from the web which could contain malicious instructions.
Ingestion points: External documentation fetched from docs.bigcommerce.com and results from WebSearch and WebFetch (SKILL.md, lines 10-12).
Boundary markers: The instructions do not define boundary markers or clear warnings to ignore embedded instructions within the fetched content.
Capability inventory: The agent has access to powerful tools including Bash, Write, and Edit which could be exploited if malicious content is processed.
Sanitization: No sanitization or validation steps are defined for the content retrieved from the web.
[EXTERNAL_DOWNLOADS]: The skill references official BigCommerce resources.
Documentation: Fetches live documentation from docs.bigcommerce.com, which is the official platform for BigCommerce developers.
NPM Packages: Recommends the installation of @bigcommerce/big-design, the official UI component library.
[CREDENTIALS_UNSAFE]: The documentation includes JSON examples for OAuth token exchange. These use obvious placeholders like your_client_id and your_client_secret, which are standard for developer documentation and do not constitute a credential leak.

bc-app-dev