commerce-app-webhooks
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes commerce operation payloads (e.g., product save, order placement) which are untrusted external data. While the skill logic is structured, the underlying LLM's handling of these parameters could be susceptible to instructions embedded in data fields.
- [COMMAND_EXECUTION]: Executes
npx @adobe/aio-commerce-lib-app initandaio app build. These are standard developer tools for the Adobe environment but involve system-level execution. - [EXTERNAL_DOWNLOADS]: The skill documentation and examples reference external URLs (e.g.,
https://fraud.example.com/check) and rely on NPM packages from the Adobe namespace (@adobe/*). As these are well-known vendor resources, they do not escalate severity.
Audit Metadata