avileo-storefront
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Downloads an official project starter from the vendor's GitHub repository (
leobar37/elena-tech) to initialize new storefront applications. - [COMMAND_EXECUTION]: Instructs users to perform standard development tasks including repository cloning (
git clone), dependency installation (bun install), and project scaffolding (npx). - [INDIRECT_PROMPT_INJECTION]: The skill operates on external data from product catalogs and a storefront assistant, creating a potential surface for indirect injection.
- Ingestion points: Retrieves product data, categories, and business information from the Avileo API as described in
SKILL.mdandreferences/tanstack-start.md. - Boundary markers: Directs the agent to use standard
AvileoProviderandStorefrontAssistantHostcomponents to manage data lifecycle. - Capability inventory: Performs authenticated network requests to the configured API and manages local file creation for development.
- Sanitization: Uses official SDK hooks and providers for data handling.
Audit Metadata