The Agent Skills Directory

[SAFE]: The skill provides secure implementation patterns for VTEX headless checkout, focusing on Backend For Frontend (BFF) proxy logic. It adheres to industry security standards and provides defensive coding examples.
[DATA_EXFILTRATION]: The instructions explicitly prevent sensitive data exfiltration by mandating PCI compliance (not routing card data through the BFF) and requiring server-side session management for sensitive identifiers like orderFormId instead of exposing them to the client-side browser storage.
[INDIRECT_PROMPT_INJECTION]: The skill mitigates the risk of indirect prompt injection by enforcing strict server-side validation and sanitization of all user-supplied input (e.g., SKU IDs, quantities, address fields) before forwarding requests to external API endpoints.
[CREDENTIALS_UNSAFE]: No hardcoded credentials or secrets were found. The code examples correctly demonstrate using environment variables for sensitive configuration like API keys.
[EXTERNAL_DOWNLOADS]: Network operations are restricted to well-known and official vendor domains (vtexcommercestable.com.br, vtexpayments.com.br) which are consistent with the skill's stated purpose and author context.
[PROMPT_INJECTION]: No patterns associated with prompt injection, safety bypasses, or instruction overrides were detected.
[OBFUSCATION]: No obfuscated code, hidden URLs, or suspicious character encodings were found.

headless-checkout-proxy