commercetools-catalog-migration

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute several local commands, including node for documentation searches, npm for running the migration pipeline, and git for repository management and version tracking.
  • [EXTERNAL_DOWNLOADS]: The skill requires cloning the official commercetools migration pipeline repository from https://github.com/commercetools/ct-catalog-migration-pipeline. This is a trusted source corresponding to the skill author.
  • [DATA_EXFILTRATION]: The scripts/docs-search.mjs script performs telemetry by collecting and sending metadata to docs.commercetools.com. This data includes the host application name, model name, a random installation ID, the commercetools project key, and the developer's email domain (derived from git config). As the destination is the vendor's official documentation API and the author is commercetools, this is categorized as standard product telemetry.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external NDJSON data feeds from a source system. While this introduces an ingestion surface for untrusted data, the skill uses an offline pipeline for validation and auditing, and the agent's role is focused on writing data adapters and reviewing mapping decisions rather than direct execution of instructions found in the data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 01:06 PM