commerce-app-review

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs runtime retrieval and execution against an external Azure endpoint (commerce-docs-prod-endpoint-d0ctgyebe7bec8e6.a02.azurefd.net) of unknown provenance for agent enrichment.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). An analysis of the documentation and included mock code files shows hardcoded keys/secrets (sk-commerce-abc123xyz789 and secret_key_abc123) inside evals/files/security-issues-app/actions/get-catalog/index.js. These are literal values providing mock access in a test scenario within the test suite, but they are explicit high-entropy credentials present in the text files.