Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/taurgis/sfcc-dev-mcp/sfcc-forms-developmentnpx skills add taurgis/sfcc-dev-mcp --skill sfcc-forms-developmentgit clone --depth 1 https://github.com/taurgis/sfcc-dev-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/taurgis/sfcc-dev-mcp/sfcc-forms-development)<a href="https://agentmods.dev/skills/taurgis/sfcc-dev-mcp/sfcc-forms-development"><img src="https://agentmods.dev/badge/skills/taurgis/sfcc-dev-mcp/sfcc-forms-development.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00047 | $0.01769 |
| Opus 5 | $0.00023 | $0.00885 |
| Sonnet 5 | $0.00009 | $0.00354 |
| Haiku 4.5 | $0.00005 | $0.00177 |
Grade A, and why
sfcc-forms-development scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 262 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SFCC Forms Development Skill
This skill guides you through implementing and troubleshooting the Salesforce B2C Commerce Forms Framework.
It covers:
- XML form definitions (schema, constraints, localization, reuse)
- Controller patterns (SFRA middleware, request handling, persistence)
- Secure validation (server-side first, CSRF/XSS protections)
- Migration guidance (SiteGenesis ➜ SFRA)
When to Use
Use this skill when you need to:
- Create or modify a form definition in
cartridge/forms/**. - Render forms in ISML using the platform’s generated field metadata.
- Process POST submissions safely (CSRF, server-side validation, transactions).
- Add custom validation beyond XML constraints.
- Migrate legacy SiteGenesis form flows to SFRA.
Quick Checklist (Production-Grade Forms)
[ ] Form routes are POST-only and HTTPS-only
[ ] CSRF token is generated on GET and validated on POST
[ ] Server-side validation gate exists (do not trust client validation)
[ ] All string fields have max-length (DoS & storage safety)
[ ] Regex is conservative (avoid catastrophic backtracking)
[ ] Persistence happens inside Transaction.wrap
[ ] SFRA persistence is isolated in route:BeforeComplete where appropriate
[ ] Explicit mapping for writes (avoid mass assignment)
[ ] Form state cleared when appropriate (pre-render or after success)
[ ] User-provided values are output-encoded in ISML
File Locations
Form XML
Forms are defined per cartridge:
/my-cartridge
/cartridge
/forms
/default
profile.xml
contact.xml
/de_DE
profile.xml
Form Labels + Error Messages (Localization)
Resource bundles typically live in:
/my-cartridge
/cartridge
/templates
/resources
forms.properties
forms_de_DE.properties
Architecture Notes (Know the Moving Parts)
- Form XML is a strict server-side contract: it defines types, constraints, and errors.
- Form instances are stored in session scope (stateful across requests) and must be cleared deliberately.
- Client-side validation is UX; server-side validation is authoritative.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 262 lines · 47 tokens per session scan A 85b1cbf1137e
sfcc-forms-development is a skill published in the GitHub repository taurgis/sfcc-dev-mcp (27 stars, last pushed 6d ago), licensed MIT. It adds 47 tokens to every session and 1,769 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nebula-logger-plugin-development
Use this skill when the user wants to build a new plugin that extends Nebula Logger - for example, custom trigger handlers on LogEntryEvente / Logc / LogEntryc, custom purge actions, or Slack-style outbound integrations. Covers the plugin framework interfaces, LoggerPluginmdt configuration, package layout, and testing…
seller-research
Use when researching a merchant, storefront, marketplace seller, or merchant of record for a buying decision, especially when identity, refund terms, fulfillment, counterfeit risk, domain history, or independent buyer outcomes are uncertain.
nebula-logger-install
Use this skill when the user wants to install and configure Nebula Logger in a Salesforce org for the first time. Covers package selection, installation paths, permissions, LoggerSettingsc hierarchy, and first-run troubleshooting.
nebula-logger-best-practices
Use this skill when the user wants to review, harden, or standardize Nebula Logger usage across a Salesforce team. Covers operational logging standards, environment-aware settings, limit-aware design, and governance guardrails.
scraperapi-price-monitoring
Use this skill whenever the user wants to check, track, or be alerted about product prices on Amazon, Walmart, or via Google Shopping. Trigger on: "monitor the price of this Amazon product", "did the price drop on [Walmart URL]?", "track these ASINs", "compare today's prices to last week", "alert me if [product] goes…
verify-product
Проверить подлинность товара по коду маркировки Честный ЗНАК.