commerce-app-migrate

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands via the Agent tool to manage the migration workflow. This includes git for creating branches and staging changes, as well as grep and sed utilities used by the Analyzer to extract environment variable names from .env and env.dist files.
  • [EXTERNAL_DOWNLOADS]: The skill performs remote execution of the @adobe/aio-commerce-lib-app package using npx (and equivalent tools for pnpm, yarn, and bun) to initialize the project structure. These downloads target the official repositories of the trusted vendor (Adobe).
  • [DYNAMIC_EXECUTION]: The Executor agent performs automated code transformation and scaffolding. It rewrites existing CommonJS action handlers into ESM modules using the defineCustomInstallationStep wrapper and generates new boilerplate code for Admin UI SDK handlers.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests a wide variety of project files, including app.config.yaml, README.md, and JavaScript registration files, to determine the project snapshot and confidence levels for different domains. This provides an attack surface for indirect prompt injection if the processed project contains adversarial instructions, although the skill implements developer confirmation checkpoints to mitigate this risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 03:59 PM