marketplace-add-xmc

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • External Resource Acquisition: The skill provides instructions to install the XM Cloud package using npx shadcn@latest add targeting a remote JSON file on marketplace-sdk.sitecorecloud.io. This is a standard procedure for adding components in modern development environments, and the source is a service-specific domain belonging to a well-known technology provider.
  • Remote Component Integration: The use of npx shadcn to add functionality involves fetching remote configuration to modify the local project structure. While this is an automated update mechanism, it is the intended method for deploying the SDK's integration components.
  • Indirect Prompt Injection Considerations: The skill outlines patterns for interacting with various APIs (Search, Authoring, etc.) that ingest data from external sources. As with any application processing external content, developers should ensure appropriate sanitization is applied to data before it is rendered or used in further logic, though the patterns provided follow standard SDK practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 10:11 AM
Security Audit — agent-trust-hub — marketplace-add-xmc