commerce-app-api-mesh
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Adobe I/O CLI (aio) to perform configuration tasks like create, update, and status. It also employs curl for GraphQL introspection, which are standard operations for an API mesh management skill.
- [EXTERNAL_DOWNLOADS]: Fetches the official Adobe plugin @adobe/aio-cli-plugin-api-mesh during setup. This is a legitimate download from a trusted source necessary for the skill's functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill contains surfaces for potential indirect prompt injection. 1. Ingestion points: mesh.json and local OpenAPI JSON files (SKILL.md). 2. Boundary markers: None explicitly provided in the templates. 3. Capability inventory: aio CLI command execution and curl network operations (SKILL.md). 4. Sanitization: None described for input data. This surface is considered safe as it involves project-local configuration files for Adobe's official tooling.
Audit Metadata