vtex-io-app-settings
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is an informational guide provided by the vendor (vtex) to ensure developers follow security best practices when handling application configuration. No malicious logic was found.
- [CREDENTIALS_UNSAFE]: The skill mentions sensitive fields like API keys and passwords only within the context of defining configuration schemas and proper handling techniques. No hardcoded credentials or secrets were identified in the content.
- [EXTERNAL_DOWNLOADS]: The skill includes links to official documentation on the developers.vtex.com domain. These are legitimate resources for the VTEX platform and represent safe external references.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a contract for ingesting merchant settings, creating an injection surface.
- Ingestion points: App settings fetched via 'ctx.clients.apps.getAppSettings' as described in the reference examples.
- Boundary markers: Explicit use of 'settingsSchema' and recommendation for normalization helpers to validate input before use.
- Capability inventory: Application settings are used to configure external API clients and business logic handlers.
- Sanitization: The skill mandates 'format: password' for sensitive fields and strictly forbids exposing secrets to the frontend or in logs.
Audit Metadata