The Agent Skills Directory

[COMMAND_EXECUTION]: Uses the b2c CLI tool (or @salesforce/b2c-cli via npx) to perform commerce operations, including listing, pulling, validating, and installing packages on B2C Commerce instances.
[EXTERNAL_DOWNLOADS]: References the official @salesforce/b2c-cli Node.js package, which is a trusted vendor resource provided for Salesforce development.
[CREDENTIALS_UNSAFE]: The skill documents the use of the b2c setup inspect --unmask command, which reveals sensitive configuration details and secrets retrieved from environment variables or local files like dw.json and ~/.mobify. This is an intended feature of the vendor's CLI for configuration debugging and auditing.
[PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by processing Commerce App Packages (CAPs) originating from external B2C instances or local file uploads.
Ingestion points: Remote B2C instances (via list, pull, and tasks commands) and local file system (via validate, package, and install commands).
Capability inventory: Shell command execution via the b2c CLI tool, which is capable of network requests and file system modifications.
Boundary markers: None described in the skill instructions; external content is processed directly by the CLI.
Sanitization: Relies on the CLI tool's internal validation logic for package content and structure.

b2c-cap