storefront-builder

Pass

Audited by Gen Agent Trust Hub on Mar 27, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: Executes shell commands for package installation and code generation using the project's detected package manager.
  • [COMMAND_EXECUTION]: Utilizes @saleor/configurator via pnpm dlx to introspect existing Saleor instances. This is a vendor-provided tool consistent with the skill author 'saleor'.
  • [SAFE]: The skill manages sensitive API tokens using industry-standard practices, instructing the agent to store them in environment files and explicitly warning against exposing them in client-side bundles.
  • [SAFE]: Implements a two-client pattern for GraphQL interactions, ensuring that authenticated requests are confined to server-side environments while public data is fetched anonymously.
  • [SAFE]: Includes safe parsing logic for external data (EditorJS JSON) and enforces proper price formatting using standard internationalization APIs.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 27, 2026, 01:29 PM