Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add taurgis/sfcc-dev-mcp --skill sfcc-fraud-preventiongit clone --depth 1 https://github.com/taurgis/sfcc-dev-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/taurgis/sfcc-dev-mcp/sfcc-fraud-prevention)<a href="https://agentmods.dev/skills/taurgis/sfcc-dev-mcp/sfcc-fraud-prevention"><img src="https://agentmods.dev/badge/skills/taurgis/sfcc-dev-mcp/sfcc-fraud-prevention/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/taurgis/sfcc-dev-mcp/sfcc-fraud-prevention"><img src="https://agentmods.dev/badge/skills/taurgis/sfcc-dev-mcp/sfcc-fraud-prevention.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.00807 |
| Opus 5 | $0.00024 | $0.00404 |
| Sonnet 5 | $0.00010 | $0.00161 |
| Haiku 4.5 | $0.00005 | $0.00081 |
Grade A, and why
sfcc-fraud-prevention scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SFCC Fraud Prevention (Developer Playbook)
Fraud prevention in SFCC is a system, not a single feature. This skill focuses on practical developer responsibilities:
- Detectable signals you can implement
- Where to enforce checks
- How to store state safely
- How to avoid performance and quota pitfalls
Quick Checklist
[ ] Start at the edge: eCDN rules (block obvious bad traffic)
[ ] Enforce payment checks (AVS/CVV/3DS where available)
[ ] Add server-side validation (never trust the client)
[ ] Add velocity + behavior checks using minimal state
[ ] Ensure retention + purge jobs for any temporary state objects
[ ] Log decisions carefully (no PII leakage)
Threat Taxonomy (Why It Matters to Code)
Common families you’ll see in data:
- Card-not-present fraud
- Account takeover (credential stuffing)
- “Friendly fraud” / chargebacks
- Bot-driven attacks (card testing, inventory hoarding)
Your job is to translate these into signals you can observe and validate.
Actionable Signals (Implementation-Friendly)
| Signal type | Examples |
|---|---|
| Data mismatches | IP geolocation vs billing/shipping country; name/address anomalies |
| Velocity patterns | many attempts from same IP/email/device; repeated failures then success |
| Order characteristics | unusually large order; high-risk SKUs; rush shipping |
| Identity indicators | disposable email; gibberish names; repeated address reuse |
Layered Defense Architecture
1) Edge controls (before app servers)
- Use eCDN custom rules to block/limit known abusive traffic patterns.
- Rate-limit endpoints that are common bot targets (login, add-to-cart, checkout).
2) Platform + processor basics
- Enable/enforce payment gateway features like AVS and CVV checks.
- Prefer adding friction only when risk is elevated.
3) Server-side rules and scoring
Where to implement depends on architecture:
- SFRA: controller middleware + fraud detection script points
- Headless: keep hook logic minimal; consider custom endpoints for heavier checks
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 96 lines · 49 tokens per session scan A 42c5daab01ee
sfcc-fraud-prevention is a skill published in the GitHub repository taurgis/sfcc-dev-mcp (28 stars, last pushed 5d ago), licensed MIT. It adds 49 tokens to every session and 807 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nebula-logger-plugin-development
Use this skill when the user wants to build a new plugin that extends Nebula Logger - for example, custom trigger handlers on LogEntryEvente / Logc / LogEntryc, custom purge actions, or Slack-style outbound integrations. Covers the plugin framework interfaces, LoggerPluginmdt configuration, package layout, and testing…
seller-research
Use when researching a merchant, storefront, marketplace seller, or merchant of record for a buying decision, especially when identity, refund terms, fulfillment, counterfeit risk, domain history, or independent buyer outcomes are uncertain.
nebula-logger-install
Use this skill when the user wants to install and configure Nebula Logger in a Salesforce org for the first time. Covers package selection, installation paths, permissions, LoggerSettingsc hierarchy, and first-run troubleshooting.
nebula-logger-best-practices
Use this skill when the user wants to review, harden, or standardize Nebula Logger usage across a Salesforce team. Covers operational logging standards, environment-aware settings, limit-aware design, and governance guardrails.
scraperapi-price-monitoring
Use this skill whenever the user wants to check, track, or be alerted about product prices on Amazon, Walmart, or via Google Shopping. Trigger on: "monitor the price of this Amazon product", "did the price drop on [Walmart URL]?", "track these ASINs", "compare today's prices to last week", "alert me if [product] goes…
dsers-mcp-product-py
Automate DSers product import from AliExpress/Alibaba/1688 to Shopify/Wix/WooCommerce. Use when the user wants to import, edit, price, or push dropshipping products to their store via DSers. (Python version — TypeScript version is primary).