next-theme-dev
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
ntk(Next Theme Kit) command-line interface to manage storefront themes, including syncing files and managing store connections. It also executes local Python and Node.js utility scripts (assert-geometry.mjs,readback-assert.py,validate-theme-assets.py) for automated verification of theme geometry, rendered output, and asset integrity. - [EXTERNAL_DOWNLOADS]: The skill clones the Spark starter theme and related toolkit resources from the official vendor repositories hosted on GitHub (
github.com/NextCommerceCo/*). These are recognized vendor resources associated with the skill's author and core functionality. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest design handoff packages produced by design tools, which include JSON metadata and Markdown notes.
- Ingestion points: Loads data from files such as
figma-handoff.json,sections.json,copy.json, andnotes.mdwithin a designated handoff directory. - Boundary markers: The skill requires specific directory structures and validates file identities before processing.
- Capability inventory: Subprocess execution of theme management tools (
ntk,git), network operations to authorized storefront APIs (curl), and file system modifications. - Sanitization: Employs mandatory validation scripts (
theme-figma.js validate-packageandvalidate-theme-assets.py) that enforce strict schema and content checks on design data before it is used to influence code generation or theme updates.
Audit Metadata