commercetools-integration-layer
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Instructs the user to download the official commercetools CLI and plugins from the standard npm registry. These are verified vendor resources required for the skill's primary function.
- [COMMAND_EXECUTION]: Guides the user through a development workflow involving local commands (e.g.,
pnpm test,pnpm dev,pnpm push). The instructions explicitly mandate obtaining user consent before running any installation or deployment commands, mitigating the risk of unauthorized execution. - [EXTERNAL_DOWNLOADS]: Mentions the use of
ngrokfor local testing of API extensions. The skill includes a clear warning that this opens a local server to the internet and advises the use of sandbox environments and explicit user approval. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of custom code (extensions). It addresses the risk of deploying unsafe code by providing a rigorous 'verify and push' protocol, which includes automated unit testing, local execution simulations, and a mandatory validation gate (
pnpm validate) that checks for restricted global usage before allowing a push to production.
Audit Metadata