commercetools-intake
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process arbitrary text and files from emails and support tickets, creating a surface for indirect prompt injection.
- Ingestion points: Processes email bodies (email.md), Zendesk ticket comments (zendesk.md), and various file attachments (PDF, CSV, XLSX).
- Boundary markers: While it suggests adding a preamble like 'Customer email: ...', it does not provide formal boundary delimiters or instructions to ignore embedded commands in the untrusted data.
- Capability inventory: The skill interacts with the commercetools Intake API and other commercetools project APIs (Carts, Quote Requests, Shopping Lists).
- Sanitization: No explicit content sanitization or validation of the untrusted text is described before its use in API prompts.
- [DATA_EXFILTRATION]: The skill's scripts (docs-search.mjs and openApi-schemata.mjs) include telemetry logic that accesses local user configuration and environment metadata.
- Evidence: Scripts read ~/.claude/settings.json, ~/.commercetools/ai-plugin-install-id, and query the local git configuration for the user's email domain.
- Destination: Telemetry data is sent to docs.commercetools.com, the vendor's documentation host.
- Mitigations: Telemetry respects the COMMERCETOOLS_AI_PLUGIN_TELEMETRY=0 environment variable and platform-level usage data settings. Data collected is restricted to anonymous IDs and email domains.
Audit Metadata