Borrowing it
Nothing to install: this file belongs to SalesforceCommerceCloud/b2c-developer-tooling. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/SalesforceCommerceCloud/b2c-developer-tooling/main/.claude/skills/documentation/SKILL.mdgit clone --depth 1 https://github.com/SalesforceCommerceCloud/b2c-developer-toolingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/salesforcecommercecloud/b2c-developer-tooling/documentation)<a href="https://agentmods.dev/skills/salesforcecommercecloud/b2c-developer-tooling/documentation"><img src="https://agentmods.dev/badge/skills/salesforcecommercecloud/b2c-developer-tooling/documentation/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/salesforcecommercecloud/b2c-developer-tooling/documentation"><img src="https://agentmods.dev/badge/skills/salesforcecommercecloud/b2c-developer-tooling/documentation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Rogue Agent · line 497 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.06831 |
| Opus 5.5 | $0.00015 | $0.02732 |
| Sonnet 5.5 | $0.00008 | $0.01366 |
| Haiku 4.5 | $0.00004 | $0.00683 |
Grade A, and why
documentation scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 754 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Documentation
This skill covers documentation for the Agentic B2C Developer Toolkit.
Audience and Framing
- Public docs explain capabilities, installation, configuration, and security. Describe outcomes people can request from their assistant; keep agent tool choreography, runtime internals, and implementation rationale in agent skills or contributor docs. Include technical details when they affect a user's choice.
- Write for junior developers and non-developer administrators. Lead with the task, benefit, and visible behavior; explain technical terms when needed for setup. Say "asks for approval" rather than "form elicitation" or "per-request confirmation." Keep protocol state, worker lifetimes, and execution budgets in contributor docs or agent skills. Shared features must cover CLI, IDE, and assistant use; reserve assistant-specific framing for the relevant sections.
- Link to canonical Salesforce Developer Center or Help pages for platform setup, requirements, and behavior. Toolkit guides supplement those workflows with our CLI, MCP, IDE, and skills capabilities; avoid maintaining a competing setup sequence. For Storefront Next, lead with Business Manager storefront setup and reuse its resources; link to the template's push workflow for source deployments. Keep matching agent skills aligned with those recommendations.
- Say "B2C Commerce" rather than "Commerce" alone. Use "IDE Extension" for the editor product. The TypeScript SDK is a supporting foundation, not a primary toolkit product alongside CLI, IDE, and AI tools.
- MCP tool references use compact tool-name/capability tables, access requirements, meaningful limits, and example requests. Link shared configuration/authentication; MCP Configuration covers MCP-specific settings only. Put toolset availability in a consistent Toolsets: field directly below each tool-group heading, not in prose or repeated table columns. Use subgroups when tools have different availability.
- Prefer plugin installation where supported; keep manual setup and toolset customization secondary. A brief linked mention of the Agent Plugins standard is useful; manifest/schema details are not installation guidance.
- MCP exposes skill guidance through
skills_read; it does not install those collections as native assistant skills. Separate skills installation is optional, supported alongside MCP or alone. Show collections before their install examples. - Keep optional project recommendations and copyable assistant instructions in
docs/guide/project-setup.md. Link from product pages rather than duplicating the examples. Support standalone skills and MCP use; distinguish recommendations from installation requirements and generated project files. - Safety Mode guidance leads with supported B2C operations and practical CLI, MCP, and IDE examples. Distinguish blocked actions, supported confirmations, and assistant approvals. Describe first-match rule precedence precisely; put broader agent/tool boundaries in a short scope note, not the introduction.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed 81d9229655e8
- 19d ago Changed · +38 lines 53477f4a841e
- 22d ago Changed · +24 lines ccbac398bf3e
- 23d ago Changed · +18 lines 3c05ef5e9d5f
- 1mo ago Changed · +7 lines dd74e43e84e4
- 1mo ago Changed · +6 lines 1342f4edc5af
- 1mo ago Changed · +144 lines · -13 tokens per session c18dfec58b37
- 1mo ago First seen · 517 lines · 51 tokens per session scan A 9426a4c8858b
documentation is a skill published in the GitHub repository SalesforceCommerceCloud/b2c-developer-tooling (56 stars, last pushed yesterday), licensed Apache-2.0. It adds 38 tokens to every session and 6,831 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
wikipedia
Search and read Wikipedia via x wkp — MediaWiki API, no API key, zero install; query, extract, suggest, and DDG route in one module. Load for wiki, wikipedia, encyclopedia lookup, article summary.
voiden
Create and edit Voiden .void files for API testing. Covers the .void file format and all enabled extension block types.
scaffold-project
Scaffold a new app, API, backend, fullstack project, mobile app, polyglot service, monorepo, or starter with Better Fullstack. Use when the user wants to create, start, bootstrap, initialize, or generate a project from a stack description. Prefer the bundled Better Fullstack MCP server: guidance, schema…
csharp-dotnet
Use when writing, reviewing, testing, or shipping C# / .NET code — ASP.NET Core APIs (minimal APIs vs controllers), EF Core data access, async correctness, solution layout in .cs/.csproj/.sln. NOT a Java/Spring backend (that is spring-boot), NOT a Node/TypeScript backend (that is nestjs), NOT framework-neutral REST…
migrate-oracle-forms
Assess and migrate Oracle Forms applications to Mendix — .fmb forms to pages, PL/SQL to microflows, and a staged migration strategy. Use when analysing or converting an Oracle Forms system.
business-events
Define event-driven APIs over Kafka with Mendix business event services — publish and subscribe contracts, CREATE/DROP/DESCRIBE. Use when building publish/subscribe integration between apps, or inspecting the business event services a project already has.