The Agent Skills Directory

[SAFE]: The skill provides comprehensive documentation and boilerplate code for extending e-commerce fulfillment capabilities. It adheres to secure coding practices by emphasizing workflow-based state changes and validation hooks.
[INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface for processing external data via carrier APIs and tracking webhooks. However, it explicitly instructs developers to implement signature verification (e.g., WebhookSignatureError) and validates incoming data against restricted internal status maps, effectively mitigating injection risks from third-party services.
[CREDENTIALS_UNSAFE]: The documentation references API keys and secrets in the context of defining configuration schemas (e.g., preference :api_key, :password). These are noted as being masked on read, which is a standard security feature of the framework, and no actual credentials are included in the skill content.
[REMOTE_CODE_EXECUTION]: The skill describes a plugin architecture using standard Ruby on Rails initialization patterns (after_initialize, to_prepare) to register custom logic. These are routine development practices for the targeted environment and do not involve executing untrusted or remote code.

spree-fulfillment