shopware-composable-frontends
Fail
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several official Node.js packages from the @shopware organization, such as @shopware/api-client and @shopware/composables. These are provided by a well-known vendor.
- [COMMAND_EXECUTION]: Mention is made of the @shopware/api-gen CLI tool, which is used by developers to generate TypeScript types based on their specific Shopware instance's API schema.
- [INDIRECT_PROMPT_INJECTION]: The skill describes an architecture that processes structured data from the Shopware Store API. While it defines an ingestion surface for external content, it does not include instructions for the agent to process this data in a way that bypasses safety guardrails.
- [CREDENTIALS_UNSAFE]: The documentation addresses security considerations regarding public Store API tokens and recommends the use of Vite proxies for production environments to secure backend URLs.
- [SAFE]: The reference to your-production-domain.com is a generic documentation placeholder for configuration examples. The suggestion to set NODE_TLS_REJECT_UNAUTHORIZED=0 is clearly scoped as a workaround for local development environments using self-signed certificates.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata