sales-app-extensibility
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill leverages official VTEX developer tools and libraries, including @vtex/fsp-cli and @vtex/sales-app, ensuring extensions are built using established and trusted vendor infrastructure.
- [SAFE]: It proactively guides developers toward secure API integration by recommending VTEX IO Proxy apps and providing clear, prominent warnings about the risks of direct authentication in frontend code.
- [SAFE]: A comprehensive set of static analysis rules (fsp-analyzer) is provided and enforced, blocking dangerous operations such as arbitrary code execution (eval), direct DOM manipulation, and unrestricted external resource loading from unverified CDNs.
- [SAFE]: The skill implements a strictly ordered, 7-step workflow with mandatory prerequisite checks and approval gates, preventing the generation or deployment of code without proper environment configuration and user review.
- [SAFE]: It adopts secure-by-default practices for styling and React performance, including CSS containment rules and re-render prevention, which are validated during the code generation process.
Audit Metadata