The Agent Skills Directory

[SAFE]: The skill implements a robust architecture for AI-assisted development of Wix headless sites. Key security observations include:
[EXTERNAL_DOWNLOADS]: Fetches templates and code layers from Wix's official GitHub repository (github.com/wix/skills.git) and the Wix CLI (@wix/cli). These are trusted sources according to internal rules and standard developer practices.
[CREDENTIALS_SAFE]: The skill uses a device-code login flow through the Wix CLI. It explicitly instructs the agent to never read tokens into the AI's context and to keep secrets in .env.local files, which are excluded from the repository via .gitignore.
[COMMAND_EXECUTION]: Executes standard Node.js, npm, and Wix CLI commands (e.g., npm install, wix release, wix create) to manage the project lifecycle. These are appropriate for the skill's purpose as a developer tool.
[PROMPT_INJECTION]: The instructions contain strict "never work from memory" and "fail loudly" rules, which are defensive measures to ensure the AI uses real documentation rather than hallucinated or potentially unsafe API calls.
[PRIVILEGE_ESCALATION]: No attempts to acquire elevated permissions (like sudo) or modify system-level configurations were detected. Operations are scoped to the project directory and standard OS temporary folders for login state.
[DATA_EXFILTRATION]: All network operations are directed at official Wix API endpoints (wixapis.com, wix.com) for legitimate site management and feedback purposes. The feedback mechanism requires explicit user consent before sending data.

wix-headless-kit