magento-module-dev
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exposes the agent to potential indirect prompt injection by fetching and processing external documentation.
- Ingestion points: The skill uses WebFetch to retrieve content from developer.adobe.com and encourages the use of WebSearch for build guides in SKILL.md.
- Boundary markers: No delimiters or instructions are provided to the agent to distinguish between the documentation content and potential embedded instructions.
- Capability inventory: The agent is granted Bash, Write, and Edit permissions, which could be exploited if malicious instructions are successfully injected via fetched data.
- Sanitization: There is no evidence of sanitization or validation of the content retrieved from external sources.
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation and structure guidelines from Adobe's official developer portal.
Audit Metadata