vtex-io-service-apps
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements platform-specific communication patterns using
@vtex/api. It references vendor-controlled domains such asvtexcommercestable.com.brandmyvtex.comfor internal and app-to-app routing. The use of identity tokens (ctx.vtex.authToken) follows platform security standards for service authentication.\n- [INDIRECT_PROMPT_INJECTION]: The skill outlines the development of APIs that ingest external request data, which constitutes a potential attack surface.\n - Ingestion points: Middleware examples in
SKILL.mdthat accessctx.queryandctx.body.\n - Boundary markers: Uses standard middleware chaining; no specific LLM delimiters are mentioned.\n
- Capability inventory: Use of
@vtex/apiclients for network operations andMasterDataClientfor data operations as described inSKILL.md.\n - Sanitization: Code examples demonstrate basic input validation, such as checking for the existence and type of parameters.
Audit Metadata