shopware-extension-security
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/advisories.pyfetches security advisory data from the official GitHub API (api.github.com). This is a legitimate operation to provide context on known vulnerability patterns and targets a well-known service. - [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI (
gh) viasubprocess.runto perform authenticated API calls. Risk of command injection is mitigated by strict regular expression validation of the repository input parameter in the script. - [INDIRECT_PROMPT_INJECTION]: The skill processes external content from security advisories. This creates a theoretical surface for indirect prompt injection, but it is considered a legitimate feature with low risk given the trusted source and structured processing.
Audit Metadata