vtex-io-service-runtime
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a structural guide for VTEX IO service runtime implementation and does not contain any malicious instructions, obfuscation, or persistence mechanisms.
- [SAFE]: The instructions promote security-positive configurations, such as defaulting HTTP routes to
public: falseand advising against usingsmartcacheon personalized or write-oriented endpoints to prevent data leakage. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for ingesting external data through HTTP and event surfaces. Ingestion points: Defined via
routesandeventsinservice.jsonand registered innode/index.ts. Boundary markers: None mentioned in the structural guidance. Capability inventory: Handlers registered innode/index.tshave access to network clients and state viaServiceContext. Sanitization: Not addressed in this structural guide, as the focus is on execution model rather than data validation. - [SAFE]: All identified dependencies, including
@vtex/apiandaxios, are either reputable vendor-specific libraries or well-known packages.
Audit Metadata