marketplace-scaffold
Pass
Audited by Gen Agent Trust Hub on Mar 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Remote Configuration Fetching: The skill uses
npx shadcn@latest addto download and apply project templates fromhttps://marketplace-sdk.sitecorecloud.io/r/. This is a standard method for distributing and installing component-based SDKs and architectural scaffolds. - Project Initialization Commands: The skill executes CLI commands such as
npx create-next-appandnpm run dev. These are routine commands used in modern web development to bootstrap and test local environments. - Environment Variable Templating: The skill provides a reference for setting up
.env.localfiles. It correctly uses placeholders for sensitive data (e.g.,your-auth0-client-secret) and provides instructions for generating secure secrets locally using standard tools likeopenssl. - Content Security Policy Configuration: The skill proactively suggests a security header configuration in
next.config.tsto restrict iframe embedding to authorized Sitecore domains, demonstrating a security-conscious approach to application setup.
Audit Metadata