commerce-app-storage

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the user to install official Adobe Node.js packages and CLI plugins required for database integration.
  • Evidence: npm install @adobe/aio-lib-db and aio plugins install @adobe/aio-cli-plugin-app-storage.
  • Trusted Source: All downloads originate from the official Adobe ecosystem, which is a well-known and trusted vendor.
  • [COMMAND_EXECUTION]: The skill utilizes standard Adobe App Builder CLI commands for project initialization and database provisioning.
  • Evidence: Usage of npx @adobe/aio-commerce-lib-app init, aio app build, aio app deploy, and aio app db provision.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external sources (HTTP requests, Commerce events, and webhooks) to be stored in a database, creating a potential surface for indirect prompt injection if the stored data is later rendered in an LLM context without sanitization.
  • Ingestion points: params.document in web actions, params.data.value in event handlers, and params.order in webhook handlers.
  • Capability inventory: Database read/write operations and IMS access token retrieval.
  • Boundary markers: Not applicable as this is a data storage integration skill.
  • Sanitization: Not explicitly implemented in the provided storage boilerplate, as it focuses on data persistence.
  • [DYNAMIC_EXECUTION]: The skill involves a platform-specific custom installation mechanism where developer-authored scripts are dynamically loaded.
  • Evidence: Registration of scripts like ./scripts/setup-database.ts in the application configuration, which are executed by the platform's installation action using ES module imports.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 03:59 PM