vendure-troubleshooting
Fail
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and interacts with official Vendure documentation and management endpoints, including
https://docs.vendure.io/mcp,https://console.vendure.io, andhttps://api.vendure.io. These are vendor-owned resources used for retrieving documentation and project status. - [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to execute local commands for project diagnosis, such asvendure doctor,vendure migrate, and checking tool versions (node --version,pnpm --version). These operations are essential for its primary troubleshooting purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes local project configuration files, dependency lists, and user-provided logs to generate troubleshooting contexts.
- Ingestion points: Reads
package.json,vendure-config.ts, lockfiles, and optional user logs incontext.md. - Boundary markers: Uses a structured "Vendure context" text block for communication with the Docs MCP and requires showing the summary to the user before transmission.
- Capability inventory: Employs
Bashfor CLI diagnostics and network communication via the Docs MCP server. - Sanitization: Includes explicit instructions to exclude environment files (
.env), credentials (auth.json), and database contents, and mandates the removal of sensitive tokens or connection strings from logs.
Recommendations
- Contains 8 malicious URL(s) - DO NOT USE
Audit Metadata