commercetools-connect
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes documentation content fetched from the official vendor API at runtime.
- Ingestion points:
scripts/docs-search.mjsretrieves results fromhttps://docs.commercetools.com/apis/rest/tools/documentation-search. - Boundary markers: Not present; the content is provided as direct context to the agent.
- Capability inventory: The agent can execute scripts for schema inspection and generate integration code.
- Sanitization: The retrieval script filters out certain content types to minimize injection risk.
- [EXTERNAL_DOWNLOADS]: The skill uses Node.js scripts to fetch live documentation and API metadata from vendor-controlled domains.
- Evidence:
scripts/docs-search.mjs,scripts/graphql-schemata.mjs, andscripts/openApi-schemata.mjsperform HTTP GET requests todocs.commercetools.com. - Context: These operations are part of the core functionality to provide up-to-date grounding for the AI agent and are conducted against trusted vendor infrastructure.
Audit Metadata