saleor-dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and fetches documentation from official Saleor resources, including
docs.saleor.ioand their public GitHub repositories for MacawUI. - [INDIRECT_PROMPT_INJECTION]: The skill documents the App Bridge architecture which involves the exchange of data between the host dashboard and the extension via the
postMessageAPI. - Ingestion points: The extension receives initial state, authentication tokens, and theme data from the dashboard during the handshake process as described in
SKILL.md. - Boundary markers: The documentation includes explicit security instructions to verify the message origin before processing any data.
- Capability inventory: The skill is configured with
Read,Write,Edit, andBashtools. - Sanitization: Best practices for origin verification and the use of the
ResizeObserverfor controlled UI adjustments are recommended in the instructions.
Audit Metadata