skills/adobe/skills/commerce-app-init/Gen Agent Trust Hub

commerce-app-init

Pass

Audited by Gen Agent Trust Hub on Aug 8, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches official dependencies using npx @adobe/aio-commerce-lib-app. These resources are provided by the trusted vendor (Adobe) as part of the project scaffolding process.\n- [COMMAND_EXECUTION]: Executes aio app build and npx commands to manage the application lifecycle and dependency installation. These are standard operations for the Adobe App Builder framework.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. 1. Ingestion points: User intent for metadata fields in SKILL.md. 2. Boundary markers: Absent in the file creation block for app.commerce.config.ts. 3. Capability inventory: The generated configuration is processed by npx and aio app build. 4. Sanitization: Instructions specify alphanumeric constraints for the id field and semver for version, though the free-text description field lacks specific escaping instructions.\n- [CREDENTIALS_UNSAFE]: No hardcoded secrets or unauthorized access to sensitive local credentials (e.g., .ssh or .aws) were identified.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 8, 2026, 02:18 PM
Security Audit — agent-trust-hub — commerce-app-init