marketplace-add-xmc
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Resource Acquisition: The skill provides instructions to install the XM Cloud package using
npx shadcn@latest addtargeting a remote JSON file onmarketplace-sdk.sitecorecloud.io. This is a standard procedure for adding components in modern development environments, and the source is a service-specific domain belonging to a well-known technology provider. - Remote Component Integration: The use of
npx shadcnto add functionality involves fetching remote configuration to modify the local project structure. While this is an automated update mechanism, it is the intended method for deploying the SDK's integration components. - Indirect Prompt Injection Considerations: The skill outlines patterns for interacting with various APIs (Search, Authoring, etc.) that ingest data from external sources. As with any application processing external content, developers should ensure appropriate sanitization is applied to data before it is rendered or used in further logic, though the patterns provided follow standard SDK practices.
Audit Metadata