The Agent Skills Directory

[SAFE]: The skill implements 'Grounding rules' that require the agent to verify deployment domains (e.g., via Vercel commands) and perform read-back verification after mutations using salla_apps action=get. This ensures configuration reliability and prevents silent failures during the app creation process.
[EXTERNAL_DOWNLOADS]: The salla_upload tool fetches app assets from a remote source_url. This is standard functionality for configuring app logos and marketplace listings on the vendor's platform.
[REMOTE_CODE_EXECUTION]: The skill facilitates the creation and management of JavaScript-based 'App Functions' via the salla_functions tool. These functions are intended business logic designed to be hosted and executed on the Salla platform to automate store events.
[PROMPT_INJECTION]: The skill acknowledges an indirect prompt injection surface where App Function handlers process merchant-provided input.
Ingestion points: Merchant input is received in the context.payload.data.fields object within onboarding step handlers (references/onboarding-steps.md).
Boundary markers: Instructions rely on developer validation rather than strict platform-enforced delimiters.
Capability inventory: The saved functions can interact with the Salla API and perform logic based on the received input.
Sanitization: The skill provides explicit guidance to 'validate or run custom logic' on the fields and to store credentials only in encrypted or hashed formats.
[SAFE]: The documentation includes security warnings regarding the use of external capture services like webhook.site, explicitly advising against the transmission of production secrets, signing secrets, or PII.

salla-app-builder