The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads an environment initialization script from https://www.wix.com/skills/headless/entry/bootstrap.mjs.
[REMOTE_CODE_EXECUTION]: It executes the downloaded bootstrap.mjs script with the Node.js runtime to facilitate the Wix CLI authentication flow.
[COMMAND_EXECUTION]: It performs several administrative shell tasks including npx @wix/cli, npm install, and curl to setup Wix apps and release the site.
[DATA_EXFILTRATION]: The skill reads sensitive credentials from the .env file (such as WIX_WIX_CLIENT_SECRET) and transmits them to https://www.wixapis.com/oauth2/token. This is the standard OAuth procedure for the vendor's integration services.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill accepts "user intent" text from the prompt to determine which business verticals to install (documented in SKILL.md and DISCOVERY.md).
Boundary markers: No specific delimiters are used to separate the user-provided intent from internal instructions.
Capability inventory: The skill uses Bash(curl), Bash(npx), and Bash(node) to perform site configuration and data seeding across all provided modules.
Sanitization: The skill does not explicitly describe validation or escaping of user intent before using it to drive API requests.

wix-headless