commerce-app-init
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches official dependencies using
npx @adobe/aio-commerce-lib-app. These resources are provided by the trusted vendor (Adobe) as part of the project scaffolding process.\n- [COMMAND_EXECUTION]: Executesaio app buildandnpxcommands to manage the application lifecycle and dependency installation. These are standard operations for the Adobe App Builder framework.\n- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. 1. Ingestion points: User intent for metadata fields inSKILL.md. 2. Boundary markers: Absent in the file creation block forapp.commerce.config.ts. 3. Capability inventory: The generated configuration is processed bynpxandaio app build. 4. Sanitization: Instructions specify alphanumeric constraints for theidfield and semver forversion, though the free-textdescriptionfield lacks specific escaping instructions.\n- [CREDENTIALS_UNSAFE]: No hardcoded secrets or unauthorized access to sensitive local credentials (e.g.,.sshor.aws) were identified.
Audit Metadata