commercetools-catalog-migration
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several local commands, including
nodefor documentation searches,npmfor running the migration pipeline, andgitfor repository management and version tracking. - [EXTERNAL_DOWNLOADS]: The skill requires cloning the official commercetools migration pipeline repository from
https://github.com/commercetools/ct-catalog-migration-pipeline. This is a trusted source corresponding to the skill author. - [DATA_EXFILTRATION]: The
scripts/docs-search.mjsscript performs telemetry by collecting and sending metadata todocs.commercetools.com. This data includes the host application name, model name, a random installation ID, the commercetools project key, and the developer's email domain (derived fromgit config). As the destination is the vendor's official documentation API and the author is commercetools, this is categorized as standard product telemetry. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external NDJSON data feeds from a source system. While this introduces an ingestion surface for untrusted data, the skill uses an offline pipeline for validation and auditing, and the agent's role is focused on writing data adapters and reviewing mapping decisions rather than direct execution of instructions found in the data.
Audit Metadata