vendure-cli
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to run the vendure CLI, dynamically selecting the appropriate runner (npx, yarn, pnpm, or bunx) based on the project's lockfile.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from project files which could potentially contain adversarial instructions. 1. Ingestion points: Reads package.json, tsconfig.json, and .env files (SKILL.md, commands/doctor.md). 2. Boundary markers: No specific delimiters or instructions to ignore embedded content are provided. 3. Capability inventory: Executes shell commands and performs file read/write operations. 4. Sanitization: Relies on the underlying CLI tool for input safety.
- [DYNAMIC_EXECUTION]: The skill supports extending functionality via CLI plugins and performing automated code transforms (codemods), which modify the project's behavior at runtime (commands/plugins.md, commands/codemod.md).
Audit Metadata