storefront-best-practices
Pass
Audited by Gen Agent Trust Hub on Feb 15, 2026
Risk Level: LOW
Full Analysis
- [SAFE] (SAFE): No malicious patterns or security risks detected within the 17 documentation files.
- [PROMPT_INJECTION] (SAFE): Use of emphasis markers like 'CRITICAL' and 'IMPORTANT' is strictly confined to UX best practices (e.g., displaying variant details) and technical implementation details (e.g., CSS positioning rules). No attempts to override agent instructions or bypass safety filters were found.
- [DATA_EXFILTRATION] (SAFE): Recommendations regarding 'localStorage' and network 'fetch' requests are standard for ecommerce functionality, such as persisting cart IDs or retrieving product data from a specified backend like Medusa. No unauthorized data access or exfiltration patterns are present.
- [INDIRECT_PROMPT_INJECTION] (LOW): The skill guides the agent in building components that process user-generated content (search queries, reviews, contact forms). However, the documentation explicitly recommends security best practices, including input validation and sanitization, reducing the risk of indirect injection in the resulting implementation.
- [REMOTE_CODE_EXECUTION] (SAFE): No remote code patterns or untrusted script execution found. External references are limited to established ecommerce platforms and standard web APIs.
Audit Metadata