vtex-io-graphql-api
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard instructional content and templates for building GraphQL schemas and resolvers within the VTEX IO ecosystem.
- [EXTERNAL_DOWNLOADS]: The skill references several official documentation pages from developers.vtex.com, which is a well-known vendor service in the e-commerce technology space.
- [COMMAND_EXECUTION]: Describes the process of linking and testing apps using the VTEX CLI, a standard developer tool for the platform.
- [INDIRECT_PROMPT_INJECTION]: The provided resolver example uses direct string interpolation in a database query (e.g., 'where: productId=${productId} AND approved=true'). This creates an attack surface for query injection if the productId argument is not properly sanitized, potentially allowing an attacker to bypass filters like the 'approved=true' constraint.
Audit Metadata