saleor-development
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates best practices for building secure commerce integrations.
- [EXTERNAL_DOWNLOADS]: The skill instructs users to download and install official Saleor tools, including @saleor/cli via npm and project bootstrapping via npx @saleor/app-sdk. These resources originate from the official Saleor platform, a well-known technology provider.
- [COMMAND_EXECUTION]: The documentation includes standard commands for local development environment setup, such as git clone for the official platform repository and docker compose up to start the backend services.
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for handling external data via webhooks. It explicitly mitigates risk by instructing developers to use the SaleorAsyncWebhook wrapper for HMAC-SHA256 signature verification, ensuring that only authenticated payloads from the Saleor instance are processed.
- [CREDENTIALS_UNSAFE]: The provided code samples demonstrate secure secret management by accessing sensitive values like API tokens and URLs through environment variables (process.env) rather than hardcoding them in the source code.
Audit Metadata