The Agent Skills Directory

[SAFE]: The skill instructs the agent to fetch documentation from docs.medusajs.com. MedusaJS is a well-known commerce platform, and retrieving official documentation from their domain is a standard and safe practice.
[DATA_EXPOSURE]: No hardcoded credentials, sensitive file paths (such as .env, .ssh, or .aws), or unauthorized network operations were found.
[COMMAND_EXECUTION]: While the skill allows the Bash tool, no suspicious shell commands, privilege escalation (e.g., sudo), or persistence mechanisms were detected.
[PROMPT_INJECTION]: The instructions do not contain patterns intended to bypass safety filters, override agent behavior, or extract system prompts. The language is purely instructional for development tasks.
[INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface through WebFetch and WebSearch targeting official documentation. While this creates a theoretical entry point for instructions if the source were compromised, the risk is negligible as it targets a well-known, trusted technical resource for its primary purpose.

medusa-api-routes