commerce-app-eventing
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Adobe I/O CLI (
aio) to manage workspace API subscriptions and build the application environment. These are official vendor commands used for their documented administrative purposes. - [EXTERNAL_DOWNLOADS]: The skill invokes
npx @adobe/aio-commerce-lib-app initto fetch and initialize the official Adobe Commerce application library. This is a standard project setup procedure using a trusted vendor package. - [DYNAMIC_EXECUTION]: The skill generates runtime action skeletons in TypeScript or JavaScript and modifies configuration files based on user requirements. This generation uses predefined templates and validated input, following standard development automation patterns.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests existing project configuration and user-defined event metadata to update the application state.
- Ingestion points: The skill reads
app.commerce.config.tsandext.config.yamlto merge new event definitions. - Boundary markers: The skill relies on structured configuration files and specific validation constraints defined in Step 2 to delimit data.
- Capability inventory: The skill possesses the ability to write to the project file system and execute project build/configuration commands.
- Sanitization: Strict validation rules are enforced for event names, labels, and operator types, including regex matching and length limitations, to ensure configuration integrity.
Audit Metadata