medusa-development
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official documentation and packages from Medusa, a well-known commerce framework. It directs users to https://docs.medusajs.com/llms-full.txt for additional resources and utilizes @medusajs scoped packages for core functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for ingesting external data through API routes and subscribers, which are then processed by workflows.
- Ingestion points: Data enters through req.validatedBody in API route src/api/store/loyalty/[id]/route.ts and event.data in src/subscribers/order-placed.ts.
- Boundary markers: Snippets show the use of req.validatedBody, indicating that input is validated against a schema before being passed to business logic.
- Capability inventory: Workflows like redeemLoyaltyPointsWorkflow in src/workflows/redeem-loyalty-points.ts have the capability to perform database writes via updateLoyaltyAccounts.
- Sanitization: Input is processed through the Medusa framework's structured data models and Workflow SDK, ensuring that operations are scoped and validated.
Audit Metadata