marketplace-order-hook
Pass
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill promotes security best practices by requiring mandatory webhook authentication validation of
Origin.AccountandOrigin.Keyfields to prevent unauthorized event processing.- [SAFE]: Instructions correctly advise on implementing idempotency using a combination ofOrderId,State, andLastChangeto prevent duplicate processing of at-least-once delivery events.- [SAFE]: All code examples use environment variables (process.env.VTEX_APP_KEY, etc.) for sensitive credentials rather than hardcoding them, following standard security practices.- [SAFE]: External communication is restricted to official VTEX domains (vtexcommercestable.com.br) and user-defined integration endpoints, which are consistent with the skill's stated purpose.- [SAFE]: The skill correctly handles all order statuses and includes a default fallback case for unrecognized statuses, preventing integration crashes on unidentified data.
Audit Metadata