commerce-app-init

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes npx to fetch and execute the @adobe/aio-commerce-lib-app package. It also recommends installing the appbuilder-project-init skill from the official Adobe skills repository. These represent official vendor resources used for project initialization.
  • [COMMAND_EXECUTION]: The skill provides instructions for executing npx and aio CLI commands. These are standard development tools within the Adobe App Builder ecosystem used for scaffolding and building the application.
  • [INDIRECT_PROMPT_INJECTION]: The skill incorporates user-provided intent to generate the metadata fields within app.commerce.config.ts.
  • Ingestion points: User-provided application details (id, displayName, description) are used to populate the configuration file as described in SKILL.md.
  • Boundary markers: The instructions explicitly require the agent to confirm the derived metadata values with the user before writing the file to disk.
  • Capability inventory: The skill has the capability to execute shell commands using npx and aio as documented in SKILL.md.
  • Sanitization: The skill identifies specific validation constraints for id (alphanumeric and hyphens) and version (numeric semver). Additionally, aio app build serves as a validation step that checks the final configuration for schema errors.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 04:37 PM