headless-caching-strategy
Pass
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as an educational resource for implementing performance optimizations in a headless commerce context. Its guidelines emphasize data privacy by explicitly prohibiting the caching of transactional or personal information.
- [DATA_EXFILTRATION]: The skill includes code examples that perform network operations using
fetchto interact with the VTEX platform's public APIs (e.g.,vtexcommercestable.com.br). These requests are targeted at the vendor's official infrastructure and are required for the skill's stated purpose of fetching catalog and search data. - [PROMPT_INJECTION]: The provided code templates define an attack surface for indirect prompt injection by processing external input within a Backend-for-Frontend (BFF) architecture.
- Ingestion points: Code examples in
SKILL.mdingest data throughreq.params,req.body, and custom headers likex-admin-key. - Boundary markers: Not explicitly implemented in the demonstrative code snippets.
- Capability inventory: The logic includes network request capabilities via
fetchand persistent storage viaRedisor in-memory maps. - Sanitization: The skill demonstrates basic sanitization and authorization practices, such as validating administrative keys against environment variables before performing cache invalidation.
Audit Metadata