Ecommerce

Build and operate online stores with payment security, inventory management, marketplace integration, and conversion optimization.

Security Scan

This is an instruction-only ecommerce guidance skill (docs and code examples) and its requirements and behavior are consistent with its stated purpose—it does not request credentials, binaries, or install code.

Purpose & Capability

The name and description (building and operating stores) match the contents: architecture guidance, operations, platform comparisons, growth tactics and code examples. Nothing in the package requires unrelated privileges or credentials.

Instruction Scope

All runtime instructions are documentation and code snippets (best practices for webhooks, inventory updates, CRO, operations). The SKILL.md explicitly states it will not connect to live store APIs or store credentials. No instructions ask the agent to read system files, environment variables, or transmit data to unexpected endpoints.

Install Mechanism

No install spec and no code files to execute — this is instruction-only, the lowest-risk model for install behavior.

Credentials

The skill declares no required environment variables, no primary credential, and no config path access. Example code references (e.g., webhookSecret, db) are illustrative only and not requested by the skill itself.

Persistence & Privilege

The skill is not marked 'always' and does not request persistent system or other-skills modifications. Autonomous agent invocation is allowed (platform default) but is not combined with any broad privileges or credentials.

Assessment

This skill is a library of ecommerce best practices and code examples only — it won't install or run code or ask for your keys. Still be cautious when copying sample code into production: replace placeholder secrets (e.g., webhookSecret), validate any database/transaction logic in your environment, and never paste real credentials into an agent chat. If you later add connectors that let the agent act on your live store, re-evaluate access controls and credentials carefully.

Quick Reference

Topic	File
Code traps that break production	code-traps.md
Platform comparison (costs, features)	platforms.md
Operations (stock, shipping, returns)	operations.md
Growth (CRO, upsells, LTV, benchmarks)	growth.md

Critical Code Traps

These break production and cost real money. See code-traps.md for full patterns.

1. Payment idempotency — Store payment_intent_id, check before processing. Webhooks retry.
2. Inventory race conditions — UPDATE ... WHERE stock > 0 with rowsAffected check, not read-then-write.
3. Frontend price trust — Backend recalculates everything. Never trust client totals.
4. Webhook signatures — Verify stripe-signature or equivalent. Reject unsigned requests.
5. Stock validation timing — Verify at payment moment, not just add-to-cart.

Core Rules

When Building Stores

• Calculate ALL prices server-side — discounts, shipping, taxes, totals
• Queue transactional emails — never inline in checkout flow
• Add structured data (Schema.org Product) and canonical URLs from day one
• Implement webhook signature verification before going live

When Operating Stores

• Monitor stock thresholds, not just zero — alert at reorder point
• Track orders stuck in "processing" >24h — detect before customer complains
• Log payment failures with context — card decline reasons matter for recovery

When Optimizing

• Checkout recovery: 1h, 24h, 72h sequence — discount on email 3, not 1
• Free shipping threshold: current AOV + 20-30%
• Mobile: sticky add-to-cart, Apple Pay/Google Pay, LCP <2.5s

Platform Decision Tree

• Budget <€500/mo, <100 SKUs: Shopify Basic or WooCommerce self-hosted
• Multi-marketplace: Dedicated sync tool (not manual updates)
• >1000 SKUs or ERP: WooCommerce/custom with PIM integration

For Spain-specific costs (IVA, OSS, carriers), see platforms.md.

Scope

This skill helps with:

• Store architecture and payment integration
• Inventory and order management logic
• Marketplace listing optimization
• Conversion rate tactics with benchmarks
• Legal/fiscal guidance for EU/Spain ecommerce

This skill does NOT:

• Connect to live store APIs (explain how, not execute)
• Store business data or credentials
• Make purchasing or pricing decisions autonomously