bc-headless
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation and technical guides from official sources, including catalyst.dev and BigCommerce's developer portal.
- [REMOTE_CODE_EXECUTION]: Instructions include the use of
npx create-catalyst-storefront, which is the official BigCommerce utility for bootstrapping new Next.js projects. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to fetch content from external documentation sites and search for development examples, which are then processed as part of the agent's context.
- Ingestion points: Catalyst documentation URL and web search results from the BigCommerce developer portal and GitHub.
- Boundary markers: The skill does not define specific delimiters for separating fetched documentation from core instructions.
- Capability inventory: The skill has access to tools including
Bash,Write,Edit, andWebFetchto implement the fetched architecture patterns. - Sanitization: Instructions rely on official documentation sources for validation and security best practices.
Audit Metadata