marketplace-order-hook
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides architectural guidance and code templates for building VTEX order integrations. It includes a dedicated section on 'Hard constraints' that mandates security best practices such as validating
Origin.AccountandOrigin.Keyheaders to prevent unauthorized webhook events. - [SAFE]: No hardcoded credentials were found in the examples; the code correctly references environment variables (e.g.,
process.env.VTEX_APP_KEY) for sensitive API keys and tokens. - [SAFE]: The skill utilizes standard, well-known Node.js libraries (
axios,express) and points to official vendor infrastructure (vtexcommercestable.com.br) and documentation (developers.vtex.com). - [SAFE]: Comprehensive analysis for prompt injection, obfuscation, data exfiltration, and persistence mechanisms returned no findings. The instructions are aligned with legitimate development workflows for the VTEX platform.
Audit Metadata