commerce-app-review

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Outsider-authored free text is ingested from a user-supplied local app directory (e.g., action source, README, YAML files under APP_PATH) where the workflow reads files like app.config.yaml, package.json, web-src/src/, and actions/*/index.js to generate findings (Step 4).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches external guideline files at runtime via curl (https://raw.githubusercontent.com/AdobeDocs/commerce-extensibility/refs/heads/main/src/pages/app-development/app-submission-guidelines.md and https://raw.githubusercontent.com/AdobeDocs/commerce-extensibility/refs/heads/main/src/pages/admin-ui-sdk/app-review-checklist.md) and POSTs to the documentation agent (https://commerce-docs-prod-endpoint-d0ctgyebe7bec8e6.a02.azurefd.net/api/query) to enrich findings — these runtime-fetched responses directly control the agent's checks/enrichment content.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged two hardcoded credentials found in runtime code. In evals/files/security-issues-app/actions/get-catalog/index.js the constants COMMERCE_API_KEY and COMMERCE_SECRET are literal string values used directly in HTTP request headers (Authorization and X-Secret). They are not placeholders (e.g., YOUR_API_KEY) and are embedded credentials in code, so they meet the definition of secrets to flag. No other files contain similar high-entropy/usable credentials; environment files are empty or placeholders and are ignored.