node-backend
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation and references sample code from trusted sources including BigCommerce, ExpressJS, and Fastify. These references are documented neutrally as they point to official service providers. Evidence: fetches live documentation from developer.bigcommerce.com and framework sites expressjs.com and fastify.dev.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies ingestion surfaces for external platform data, which is necessary for the described use case. Evidence: 1. Ingestion points: OAuth query parameters (code, scope, context) in auth.ts and webhook request bodies in webhooks.ts. 2. Boundary markers: The instructions mandate verification of signed_payload_jwt and x-webhook-secret to ensure data integrity. 3. Capability inventory: Uses standard fetch calls for BigCommerce API communication and file writing for project structure setup. 4. Sanitization: The skill recommends standard middleware to verify and validate all incoming requests from the external platform.
Audit Metadata