woocommerce-rest-api
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill integrates with the official WooCommerce REST API client (
@woocommerce/woocommerce-rest-api) and uses thep-limitpackage for concurrency control. These are industry-standard, well-known dependencies for this use case. - [INDIRECT_PROMPT_INJECTION]: The skill includes functionality to ingest and process external data sources, such as supplier product feeds and order shipment JSON files, which represents a potential attack surface.
- Ingestion points: The
syncProductsFromCatalogfunction inSKILL.mdand the order fulfillment logic insrc/orders.tsprocess data from external JSON files (supplier-feed.json,phone-order.json). - Boundary markers: None are explicitly implemented in the provided code snippets; the skill assumes the external data follows the expected schema.
- Capability inventory: The skill utilizes network capabilities via the WooCommerce REST API client to perform CRUD operations (GET, POST, PUT).
- Sanitization: While the skill uses TypeScript interfaces to define expected data structures, it does not show explicit sanitization or validation logic for the external string inputs before they are used in API requests. This is acceptable given the primary purpose of the skill is API integration.
Audit Metadata