The Agent Skills Directory

[Indirect Prompt Injection Surface]: The skill handles rich text content (like product descriptions) fetched from Shopify's APIs. While such external data could potentially contain malicious instructions, the skill specifically instructs the agent to use sanitizeShopifyHtml and appropriate React directives to safely handle this content.
[Local Auditing Utility]: A Node.js script (scripts/audit-storefront.mjs) is provided to help developers scan their storefront source code for best practices and performance hotspots. This script performs local file reads and regex-based analysis without executing code or performing network operations.
[Trusted Resource Integration]: The skill references documentation and template source code from official Vercel and Shopify repositories. These are well-known, trusted sources for the intended storefront development workflow.
[Secure Development Practices]: The instructions emphasize data isolation, advising against placing personalized customer or cart data into public caches, which is a key security consideration for commerce applications.

build-shop