adding-entity-types
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses 'pnpm fetch-schema' to download the Saleor GraphQL schema from the project's API endpoint. This is a standard operation required for the gql.tada type system to function.
- [COMMAND_EXECUTION]: The skill utilizes development commands to manage the codebase: 'pnpm test' to run Vitest-based unit and integration tests; 'npx tsc --noEmit' to perform TypeScript type checking; 'pnpm fetch-schema' to synchronize the local GraphQL schema; 'pnpm dev introspect' to capture project state.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-defined entity specifications to generate application code. Ingestion points: User input describing the entity. Boundary markers: None explicit in code generation templates. Capability inventory: Uses 'Write' and 'Edit' tools to generate files. Sanitization: Instructions mandate Zod schema validation in the generated service layer to sanitize runtime data.
- [SAFE]: The skill incorporates security best practices such as branded types for domain safety and dependency injection for testability.
Audit Metadata