composable-commerce
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill mentions and provides code for integrating with well-known and trusted technology companies including Stripe, AWS, commercetools, Algolia, Contentful, and HashiCorp. These are recognized as trusted/well-known services and do not contribute to a negative verdict.
- [COMMAND_EXECUTION]: Provides standard Node.js/TypeScript code snippets for API integration and event handling. No dangerous shell commands or arbitrary executions detected.
- [DATA_EXFILTRATION]: While the skill involves credentials for commerce services (e.g., CTP_CLIENT_ID, STRIPE_SECRET_KEY), it correctly instructs users to provide these via environment variables and does not include hardcoded secrets or patterns for exfiltrating user data.
- [REMOTE_CODE_EXECUTION]: No patterns observed where remote content is executed on the host system.
- [INDIRECT_PROMPT_INJECTION]: As a developer-focused architectural guide, the skill consumes structured service data (catalog, orders). It does not exhibit surfaces prone to indirect prompt injection in the context of an AI agent's execution of these specific instructions.
Audit Metadata