The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes a local bash script, scripts/sw-editor.sh, to interact with the Superwall API. It uses standard utilities like curl for network requests and jq for JSON processing, all of which are scoped to the intended functionality of paywall management.
[EXTERNAL_DOWNLOADS]: The CLI communicates with superwall-mcp.superwall.com. This is the official relay domain for the Superwall editor and is considered a legitimate vendor resource for the 'superwall' author.
[CREDENTIALS_UNSAFE]: The skill manages SUPERWALL_API_KEY through environment variables or local .env files. It implements local state protection by applying chmod 600 to the state.json file, ensuring that short-lived session tokens are only accessible to the current user, which is a standard security practice.
[INDIRECT_PROMPT_INJECTION]: The skill dynamically discovers available tools from a running browser session at runtime. While this introduces a dependency on the integrity of the remote browser session's tool definitions, the surface is inherent to the live-editing workflow and is protected by the authenticated relay system.

superwall-editor