scaffolding-marketplace-integrations
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill involves ingesting untrusted data from external marketplace APIs and webhooks.
- Ingestion points: Data is ingested via webhook endpoints (e.g.,
app/api/webhooks/shopify/route.ts) and API response processing in the Shopify, WooCommerce, Bol.com, and Etsy clients. - Boundary markers: The implementation demonstrates security best practices by including HMAC signature verification with timing-safe comparisons to validate the origin and integrity of incoming data.
- Capability inventory: The provided boilerplate code includes capabilities to perform database operations (creating/updating order and product records) and make authorized network requests to modify data on marketplace platforms.
- Sanitization: While the code uses structured JSON parsing and TypeScript interfaces to enforce data structure, explicit content-level sanitization for free-text fields before database insertion or API usage is assumed to be handled by the end-user implementation.
Audit Metadata