skills/commercetools/commercetools-ai-plugins/commercetools-spec-driven-development/Gen Agent Trust Hub
commercetools-spec-driven-development
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/docs-search.mjsscript performs GET requests tohttps://docs.commercetools.com. This network operation targets an official vendor domain to provide relevant documentation as grounding context for the agent and does not involve downloading or executing untrusted code. - [COMMAND_EXECUTION]: The
scripts/setup.mjsutility performs local file system operations to modify project configuration files (e.g., in.specify/oropenspec/). The script is restricted to specific hardcoded targets and uses marker-delimited text substitution to ensure that changes are idempotent and reversible. - [INDIRECT_PROMPT_INJECTION]: The skill establishes an indirect injection surface by modifying development templates (such as
plan-template.md) that are subsequently read by agents. These instructions guide the agent to load specificcommercetools-*skills and verify actions using thecommercetools-knowledgeMCP. The process is managed using clear boundary markers and lacks unsafe interpolation of untrusted data, maintaining a safe environment for agent operations.
Audit Metadata