ce-cart-checkout
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install official vendor packages, including
@commercengine/checkout,@commercengine/storefront, and@commercengine/js. These resources originate from the vendor's official registry and infrastructure. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to demonstrate standard package management operations, specificallynpm installfor adding necessary e-commerce libraries. - [INDIRECT_PROMPT_INJECTION]: The skill involves processing user-supplied data such as product selections, coupon codes, and shipping addresses to interact with Commerce Engine APIs.
- Ingestion points: User input is accepted for cart items, shipping/billing addresses, coupon codes, and payment details (via SDK methods).
- Boundary markers: No explicit delimiters or instruction-ignore markers are specified for user-provided strings in the interpolation examples.
- Capability inventory: The skill utilizes the
Bashtool for setup and performs network operations via the vendor SDK to reach Commerce Engine endpoints. - Sanitization: The implementation patterns include validation logic for specific fields, such as card BIN lookups and UPI VPA verification, which help ensure data integrity before submission.
Audit Metadata