commerce-app-migrate
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard development tasks using git and package managers (npm, pnpm, yarn, bun). These commands are used to manage project state, install necessary dependencies, and initialize the application structure.
- [EXTERNAL_DOWNLOADS]: Official Adobe packages, specifically @adobe/aio-commerce-lib-app, are downloaded from the npm registry to perform the migration. These resources are provided by the verified vendor and are required for the skill's operation.
- [REMOTE_CODE_EXECUTION]: The migration process involves running the @adobe/aio-commerce-lib-app CLI via npx or dlx commands. This is the intended function of the skill to scaffold the new project architecture.
- [DATA_EXFILTRATION]: Project metadata and environment variable names are analyzed to build a project snapshot. The skill uses a safe approach to environment variable inspection by employing grep to extract only the keys, ensuring that actual secret values are not ingested into the agent context.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it processes untrusted local data like README.md and configuration files. Ingestion points (project files) are used to populate structured data. While boundary markers are absent, sanitization exists in the form of specific key filtering and metadata stripping, resulting in a low-risk environment. Capability inventory includes file writes, shell execution, and package installation.
Audit Metadata