commercetools-commerce-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns such as credential exfiltration, persistence, or obfuscation were identified. The skill promotes security best practices, such as using the as-associate API for B2B operations to enforce permission checks.
- [COMMAND_EXECUTION]: The skill workflow involves executing local Node.js scripts (docs-search.mjs, graphql-schemata.mjs, and openApi-schemata.mjs) to gather context. These scripts are provided with the skill and use standard argument parsing.
- [EXTERNAL_DOWNLOADS]: The included scripts fetch documentation and schema definitions from official commercetools domains (docs.commercetools.com). This is a legitimate functional requirement for providing up-to-date commerce patterns and API references.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external documentation search results. 1. Ingestion points: Output from scripts/docs-search.mjs (SKILL.md). 2. Boundary markers: The script formats results using Markdown headers and horizontal rules (scripts/docs-search.mjs). 3. Capability inventory: Execution of provided scripts for documentation and schema retrieval. 4. Sanitization: The script limits the number of results and excludes certain content types to ensure relevance. The risk is assessed as safe given the source is the official vendor documentation.
Audit Metadata