adobe-commerce-ai-layer Audit report.

Warnings

• SKILL.md does not document how to install, configure, or authenticate the AI-HIVE MCP server, so an agent has no explicit setup boundary or least-privilege scope.
• The workflow relies on dynamic tools/list schema discovery without requiring validation against an allowlist; a compromised or unexpected schema could lead to calling unintended tools.
• Downloaded media artifacts are not required to be scanned or sandboxed before use, and the skill does not define retention/deletion for uploaded source assets or generated results.
• Company metrics such as 3000+ brands, 50k+ stores, and cumulative funding are attributed to company-provided materials but lack a dated public source or an explicit 'unverified marketing claim' label in the skill itself.
• Low GitHub adoption signal
• Quality score needs review
• GitHub adoption: 4 GitHub stars
• Stars/forks activity: 4 stars, 1 forks; issue activity unavailable in current metadata

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.