commerce-js-integration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate instructions for integrating the Commerce.js platform using the official @chec/commerce.js package. No malicious behaviors or suspicious obfuscation patterns were detected.- [DATA_EXFILTRATION]: No hardcoded credentials or sensitive file access patterns were detected. The skill correctly advises the use of environment variables (e.g., NEXT_PUBLIC_CHEC_PUBLIC_KEY, CHEC_SECRET_KEY) for secret management and distinguishes between client-side and server-side key usage to prevent exposure.- [INDIRECT_PROMPT_INJECTION]: The skill identifies and mitigates an attack surface where untrusted data enters the agent context. 1. Ingestion points: product.description retrieved from Chec API in SKILL.md. 2. Boundary markers: uses explicit DOMPurify sanitization in code examples. 3. Capability inventory: limited to standard UI rendering with no dangerous subprocess, network, or file-write operations linked to the data. 4. Sanitization: provides clear instructions to use isomorphic-dompurify to clean HTML before rendering with dangerouslySetInnerHTML.
Audit Metadata