commerce-app-storage
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install official Adobe Node.js packages and CLI plugins required for database integration.
- Evidence:
npm install @adobe/aio-lib-dbandaio plugins install @adobe/aio-cli-plugin-app-storage. - Trusted Source: All downloads originate from the official Adobe ecosystem, which is a well-known and trusted vendor.
- [COMMAND_EXECUTION]: The skill utilizes standard Adobe App Builder CLI commands for project initialization and database provisioning.
- Evidence: Usage of
npx @adobe/aio-commerce-lib-app init,aio app build,aio app deploy, andaio app db provision. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from external sources (HTTP requests, Commerce events, and webhooks) to be stored in a database, creating a potential surface for indirect prompt injection if the stored data is later rendered in an LLM context without sanitization.
- Ingestion points:
params.documentin web actions,params.data.valuein event handlers, andparams.orderin webhook handlers. - Capability inventory: Database read/write operations and IMS access token retrieval.
- Boundary markers: Not applicable as this is a data storage integration skill.
- Sanitization: Not explicitly implemented in the provided storage boilerplate, as it focuses on data persistence.
- [DYNAMIC_EXECUTION]: The skill involves a platform-specific custom installation mechanism where developer-authored scripts are dynamically loaded.
- Evidence: Registration of scripts like
./scripts/setup-database.tsin the application configuration, which are executed by the platform's installation action using ES module imports.
Audit Metadata