commerce-app-init
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
npx @adobe/aio-commerce-lib-app initandaio app build. These are official Adobe CLI tools used for project initialization and validation within the Adobe App Builder ecosystem. Given the author is 'adobe', these are expected vendor-owned operations. - [EXTERNAL_DOWNLOADS]: The skill references the official Adobe Commerce SDK on GitHub (
github.com/adobe/aio-commerce-sdk) and utilizes NPM packages under the@adobescope (e.g.,@adobe/aio-commerce-lib-app). These are trusted vendor resources. - [METADATA_POISONING]: The skill documentation correctly identifies itself as a scaffolding tool and provides clear instructions on its limitations, specifically pointing users to other domain-specific skills for advanced configurations. The metadata is accurate and consistent with the behavior.
- [INDIRECT_PROMPT_INJECTION]: While the skill generates configuration based on user intent (e.g., app
id,displayName), it includes explicit validation rules (e.g., alphanumeric and hyphens only for IDs, numeric semver for versions). These constraints act as boundaries that mitigate the risk of malicious payloads being injected into the generated code.
Audit Metadata