The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to use pnpm dlx @saleor/configurator, which downloads and executes the vendor's official CLI tool. This is standard behavior for the intended purpose of the skill.
[CREDENTIALS_UNSAFE]: Security best practices are followed regarding authentication. The instructions specify that sensitive data like SALEOR_TOKEN should be provided through environment variables or .env.local files rather than being hardcoded.
[INDIRECT_PROMPT_INJECTION]: The skill processes deployment reports and CLI output. The workflow mitigates risks by using jq for structured parsing of JSON envelopes, which reduces the surface area for injection compared to raw text processing.
[COMMAND_EXECUTION]: The skill uses shell commands to interact with the Saleor environment. These commands are scoped to the primary purpose of store configuration and deployment.

configurator-workflow