saleor/saleor-app
skills/saleor-app/SKILL.md
Universal Saleor app development patterns. Covers the app protocol (manifest, registration, webhooks, authentication), SDK abstractions, settings persistence, and Dashboard integration. Framework-agnostic with Next.js examples.
development
Updated May 6, 2026
$ install --global
skillsauthnpx skillsauth add saleor/agent-skills saleor-appInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 6, 2026, 5:18 AM128.8s14 files scanned
SKILL.md
- name:
- saleor-app
- description:
- >
- license:
- MIT
- author:
- saleor
- version:
- 1.0.0
Saleor App
Guide for building apps that extend Saleor via webhooks and the GraphQL API.
Framework-agnostic protocol documentation with Next.js examples using @saleor/app-sdk.
When to Apply
- Defining an app manifest or registering webhooks
- Handling async/sync webhook events from Saleor
- Authenticating requests (registration handshake, JWT, signature verification)
- Storing app settings in Saleor metadata
- Building Dashboard UI inside the iframe
- Making GraphQL calls with app tokens
- Debugging webhook failures, auth errors, or permission issues
- Deciding who can view the app and what they should see (user vs app scope)
Rule Categories by Priority
| Priority | Category | Impact | Prefix |
| -------- | --------------- | -------- | --------------- |
| 1 | Protocol | CRITICAL | protocol- |
| 2 | Permissions | CRITICAL | permissions- |
| 3 | Webhooks | HIGH | webhook- |
| 4 | Data & Settings | HIGH | data- |
| 5 | Dashboard UI | MEDIUM | dashboard- |
| 6 | Development | MEDIUM | dev- |
Quick Reference
1. Protocol (CRITICAL)
protocol-manifest— App manifest, required endpoints, permissions, extensionsprotocol-auth— Registration handshake, APL, token scopes, JWT/signature verification
2. Permissions (CRITICAL)
permissions-access-scopes— User scope vs app scope, client-side permission checks, JWT middleware patterns
3. Webhooks (HIGH)
webhook-async— Async event handling, payload typing, retry policy, signature verificationwebhook-sync— Sync event handling, response schemas, performance constraintswebhook-external— Receiving webhooks from external services, multi-tenant routing
4. Data & Settings (HIGH)
data-graphql— GraphQL from apps: client setup, auth headers, codegen, app vs user tokensdata-settings— MetadataManager, EncryptedMetadataManager, domain-scoped persistence
5. Dashboard UI (MEDIUM)
dashboard-appbridge— AppBridge iframe protocol, actions, events, theme/locale sync
6. Development (MEDIUM)
dev-debug— Common errors, webhook dry runs, tunnel setup, debugging checklist
Related Skills
saleor/saleor-core
tools
VerifiedTrustedCommunity
Saleor backend internals and behavior reference. Covers discount precedence, order-level discount allocation across lines (two-pass calculation, what the API does and doesn't expose, gift-line shape gotchas), stock availability modes (legacy vs direct, 3.23+), Dashboard UI rules, webhook trigger conditions, denormalized field semantics, and migration footguns. Use when working with Saleor discounts or stock availability, building Dashboard UI, building price-explanation tooling, or debugging backend behavior.
2SKILL.mdUpdated May 6, 2026
saleor/storefront-builder
development
VerifiedTrustedCommunity
Saleor storefront data + UX playbook. Covers GraphQL query design, channel handling, data contracts per surface (PLP/PDP/nav/pricing/availability/media), variant-selection UX, and Saleor-specific correctness rules. Framework-agnostic — agent inspects repo and applies conventions locally.
SKILL.mdUpdated May 6, 2026
saleor/saleor-storefront
development
VerifiedTrustedCommunity
Saleor e-commerce API patterns for building storefronts. Use when working with Saleor's GraphQL API, products, variants, checkout, channels, permissions, or debugging API behavior. Framework-agnostic — applies to any Saleor storefront.
SKILL.mdUpdated May 6, 2026
saleor/saleor-configurator
development
VerifiedTrustedCommunity
Saleor Configurator patterns for managing store configuration as code. Use when writing config.yml, running deploy/introspect/diff commands, understanding entity identification (slug vs name), deployment pipeline order, or debugging sync issues.
SKILL.mdUpdated May 6, 2026