next-theme-dev

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the ntk (Next Theme Kit) command-line interface to manage storefront themes, including syncing files and managing store connections. It also executes local Python and Node.js utility scripts (assert-geometry.mjs, readback-assert.py, validate-theme-assets.py) for automated verification of theme geometry, rendered output, and asset integrity.
  • [EXTERNAL_DOWNLOADS]: The skill clones the Spark starter theme and related toolkit resources from the official vendor repositories hosted on GitHub (github.com/NextCommerceCo/*). These are recognized vendor resources associated with the skill's author and core functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest design handoff packages produced by design tools, which include JSON metadata and Markdown notes.
  • Ingestion points: Loads data from files such as figma-handoff.json, sections.json, copy.json, and notes.md within a designated handoff directory.
  • Boundary markers: The skill requires specific directory structures and validates file identities before processing.
  • Capability inventory: Subprocess execution of theme management tools (ntk, git), network operations to authorized storefront APIs (curl), and file system modifications.
  • Sanitization: Employs mandatory validation scripts (theme-figma.js validate-package and validate-theme-assets.py) that enforce strict schema and content checks on design data before it is used to influence code generation or theme updates.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 01:39 AM
Security Audit — agent-trust-hub — next-theme-dev