commerce-app-eventing
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npx @adobe/aio-commerce-lib-app initto scaffold the project and install required dependencies. This package belongs to the official vendor (@adobe) and is a standard component of the Adobe Commerce extensibility ecosystem. - [COMMAND_EXECUTION]: The skill instructs the agent to execute Adobe CLI commands, such as
aio console workspace api list/addandaio app build, to manage environment configurations and validate application state. These commands are necessary for the skill's stated purpose of managing Adobe I/O Events. - [DYNAMIC_EXECUTION]: The skill generates TypeScript configuration files and runtime action skeletons based on user input. This code generation follows strictly defined templates and is a core part of its functionality to automate event handler setup.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input (event names, labels, and descriptions) which are interpolated into configuration files and shell commands. To mitigate risk, the skill includes explicit validation rules (e.g., regex patterns for event names, character limits for labels) in Step 2, ensuring that inputs conform to expected schemas before processing.
Audit Metadata