sfnext-data-fetching
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill documents secure-by-design patterns for Storefront Next. It explicitly mandates that all SCAPI (Salesforce Commerce API) requests execute on the server (MRT server) rather than the browser, which is a best practice for protecting API credentials and sensitive customer data.
- [SAFE]: Data flow documentation clearly distinguishes between initial SSR rendering and subsequent SPA navigation, ensuring developers understand how data is fetched and processed at each stage of the application lifecycle.
- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for processing external data from URL parameters and form submissions (e.g.,
params.productId,formData.get('productId')). While this represents a standard data ingestion surface, the patterns shown pass this data to managed API clients rather than sensitive system commands. No actual injection content or unsafe interpolation into prompt contexts is present.
Audit Metadata