vtex-io-events-and-workers
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard architectural advice for VTEX IO developers. All code snippets demonstrate legitimate use of platform clients (vbase, masterdata, partnerApi) and follow established design patterns.
- [INDIRECT_PROMPT_INJECTION]: The skill documents how to process payloads from external events, which represents a potential attack surface for indirect prompt injection if the data is subsequently used in LLM prompts. However, the skill explicitly mitigates these risks by mandating idempotency, state persistence (using VBase or Master Data), and strict schema validation, aligning with secure development practices.
- [SAFE]: All external references and documentation links target the official VTEX developer portal (developers.vtex.com) and the VTEX Broadcaster app, which are trusted vendor resources.
Audit Metadata