commerce-app-init
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto fetch and execute the@adobe/aio-commerce-lib-apppackage. It also recommends installing theappbuilder-project-initskill from the official Adobe skills repository. These represent official vendor resources used for project initialization. - [COMMAND_EXECUTION]: The skill provides instructions for executing
npxandaioCLI commands. These are standard development tools within the Adobe App Builder ecosystem used for scaffolding and building the application. - [INDIRECT_PROMPT_INJECTION]: The skill incorporates user-provided intent to generate the metadata fields within
app.commerce.config.ts. - Ingestion points: User-provided application details (id, displayName, description) are used to populate the configuration file as described in
SKILL.md. - Boundary markers: The instructions explicitly require the agent to confirm the derived metadata values with the user before writing the file to disk.
- Capability inventory: The skill has the capability to execute shell commands using
npxandaioas documented inSKILL.md. - Sanitization: The skill identifies specific validation constraints for
id(alphanumeric and hyphens) andversion(numeric semver). Additionally,aio app buildserves as a validation step that checks the final configuration for schema errors.
Audit Metadata