commerce-app-migrate
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands via the Agent tool to manage the migration workflow. This includes
gitfor creating branches and staging changes, as well asgrepandsedutilities used by the Analyzer to extract environment variable names from.envandenv.distfiles. - [EXTERNAL_DOWNLOADS]: The skill performs remote execution of the
@adobe/aio-commerce-lib-apppackage usingnpx(and equivalent tools for pnpm, yarn, and bun) to initialize the project structure. These downloads target the official repositories of the trusted vendor (Adobe). - [DYNAMIC_EXECUTION]: The Executor agent performs automated code transformation and scaffolding. It rewrites existing CommonJS action handlers into ESM modules using the
defineCustomInstallationStepwrapper and generates new boilerplate code for Admin UI SDK handlers. - [INDIRECT_PROMPT_INJECTION]: The skill ingests a wide variety of project files, including
app.config.yaml,README.md, and JavaScript registration files, to determine the project snapshot and confidence levels for different domains. This provides an attack surface for indirect prompt injection if the processed project contains adversarial instructions, although the skill implements developer confirmation checkpoints to mitigate this risk.
Audit Metadata