The Agent Skills Directory

[COMMAND_EXECUTION]: The documentation suggests that developers or automated agents should perform a syntax check on generated JavaScript snippets using node --check snippet.js prior to deployment.
[DYNAMIC_EXECUTION]: The skill recommends using the new Function(code) constructor within a try/catch block as a method to validate the syntax of JavaScript snippets before they are injected into the storefront.
[EXTERNAL_DOWNLOADS]: The instructions describe common storefront patterns such as loading third-party tracker scripts at runtime using document.createElement('script') or dynamic imports.
[DATA_EXFILTRATION]: The implementation guide provides examples of using the fetch API to send storefront event data (e.g., product additions, cart updates) to a developer-specified backend URL for analytics or synchronization purposes.
[INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data, as storefront snippets ingest event payloads (e.data) and configuration settings (salla.config.get) directly from the browser environment.
Ingestion points: Storefront events (e.g., cart::item.added), salla.config.get('app.<key>'), and browser-level configuration objects in SKILL.md and references/device-mode.md.
Boundary markers: The documentation advises against including secrets in client-side code and suggests server-side re-validation of all incoming tracking data.
Capability inventory: The skill uses the salla_snippets tool to modify storefront behavior and utilizes browser fetch for external communication.
Sanitization: The skill emphasizes that developers must treat every POST request to their backend as untrusted and perform server-side validation.

salla-snippets