marketplace-catalog-sync
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements legitimate catalog synchronization logic for VTEX platforms. All external requests are directed to official VTEX domains such as api.vtex.com and vtexcommercestable.com.br.
- [SAFE]: Credential handling follows best practices by utilizing environment variables for App Keys and App Tokens (process.env.VTEX_APP_KEY and process.env.VTEX_APP_TOKEN) instead of hardcoding sensitive values.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted catalog data. * Ingestion points: SKU data is ingested through the skuData parameter in integrateSellerSku and the request body in the fulfillmentSimulationHandler endpoint. * Boundary markers: The implementation relies on structured TypeScript interfaces to define the shape of incoming data. * Capability inventory: The skill has the ability to perform network requests and state changes in the marketplace catalog via authenticated VTEX API calls. * Sanitization: Input data is mapped to specific object fields, providing structural validation, though no explicit string sanitization is demonstrated.
Audit Metadata