deco-storefront-test-checklist
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
rg(ripgrep) andlsto search through the site's source code for component registration, routes, and interactive patterns. These are standard development activities for codebase discovery. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes project source code to generate its checklist.
- Ingestion points: Site source files in
src/(referenced in SKILL.md). - Boundary markers: Absent; site content is read directly into the agent context.
- Capability inventory: The skill utilizes
bashcommands for code discovery and execution of standardnpmbuild scripts. - Sanitization: No sanitization is performed on the ingested code strings; the skill relies on the user to interpret results.
- [EXTERNAL_DOWNLOADS]: The skill mentions official vendor packages including
@decocms/blocks,@decocms/blocks-admin,@decocms/tanstack,@decocms/nextjs,@decocms/start, and@decocms/apps. These represent legitimate infrastructure for the Deco ecosystem.
Audit Metadata