The Agent Skills Directory

[SAFE]: The skill is a specialized utility for generating migration code. It incorporates numerous security best practices and safety measures:
[CREDENTIALS_SAFE]: The skill provides templates for .env files to store sensitive platform credentials and site tokens. It explicitly instructs the generated code to never hardcode secrets, fail fast if they are missing, and never log or dump secret values in debug output.
[COMMAND_EXECUTION]: While the skill instructs users to install tools like ngrok for handling local media tunnels, this is a standard developer practice for testing and does not involve malicious commands or unauthorized privilege escalation.
[REMOTE_CODE_EXECUTION]: The primary function of this skill is to generate JavaScript entrypoints (extract-source.js, run-import.js). These are generated based on local schema and mapping artifacts rather than fetching untrusted remote payloads. It promotes the use of a verified internal library (rp-target-wix/lib/wix-writers.js) to ensure API request shapes are correct and secure.
[DATA_EXFILTRATION]: The skill generates code to transfer data between a source platform and Wix. It includes safeguards such as requiring extraction to durable local files first, using client-controlled IDs for idempotency, and providing a dry-run mode to validate code paths without performing live writes.
[INDIRECT_PROMPT_INJECTION]: The skill processes external artifacts (JSON schema and Markdown mapping plans) to drive code generation. While this presents an attack surface for indirect injection, the skill defines strict contracts for reading and writing data, uses verified primitives, and mandates validation via real calls, which significantly mitigates the risk of processing malicious instructions embedded in data.

rp-import-codegen