marketplace-fulfillment
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill provides legitimate technical documentation for e-commerce integrations within the VTEX ecosystem.
- [EXTERNAL_DOWNLOADS]: The skill mentions an official reference implementation in the
vtex-apps/external-seller-exampleGitHub repository. This is a trusted resource belonging to the vendor's official organization. - [COMMAND_EXECUTION]: The provided TypeScript examples use standard libraries like Express and Axios for building web services and making API calls. The implementation follows documented protocol constraints (e.g., the 2.5-second SLA) and does not use any dangerous system commands or dynamic execution patterns.
- [INDIRECT_PROMPT_INJECTION]: While the skill defines how to ingest data via HTTP POST requests (e.g.,
POST /pvt/orderForms/simulation), it does so in the context of a structured API protocol. The logic is limited to mapping JSON fields and performing price/stock calculations, presenting no significant surface for prompt injection against the agent.
Audit Metadata