salla-app-functions-validate
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions include a command to fetch TypeScript declaration files (
.d.ts) from a remote URL usingcurl. This is used to provide the TypeScript compiler with the necessary type information for the specific Salla App Function trigger. The URLhttps://…/shipments.d.tsserves as a placeholder for resources provided by the vendor's infrastructure. - [COMMAND_EXECUTION]: The skill utilizes
npxto execute the TypeScript compiler (tsc) locally for code validation. This process uses the--noEmitflag, ensuring that no executable files are generated and that the tool is only used for static analysis and type checking of the handler code. - [SAFE]: The instructions contain a specific security best practice section advising developers to keep credentials (secrets, tokens, API keys) in App Settings (read via
context.settings) rather than hardcoding them in the saved source code. - [SAFE]: The skill uses localized tool execution (
salla_functions) and standard developer utilities that are consistent with the vendor's (SallaApp) intended use case for app development and validation.
Audit Metadata