marketplace-fulfillment

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No security issues detected. The skill provides legitimate technical documentation for e-commerce integrations within the VTEX ecosystem.
  • [EXTERNAL_DOWNLOADS]: The skill mentions an official reference implementation in the vtex-apps/external-seller-example GitHub repository. This is a trusted resource belonging to the vendor's official organization.
  • [COMMAND_EXECUTION]: The provided TypeScript examples use standard libraries like Express and Axios for building web services and making API calls. The implementation follows documented protocol constraints (e.g., the 2.5-second SLA) and does not use any dangerous system commands or dynamic execution patterns.
  • [INDIRECT_PROMPT_INJECTION]: While the skill defines how to ingest data via HTTP POST requests (e.g., POST /pvt/orderForms/simulation), it does so in the context of a structured API protocol. The logic is limited to mapping JSON fields and performing price/stock calculations, presenting no significant surface for prompt injection against the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:53 PM