sfcc-webdav-workflows — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sfcc-webdav-workflows (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
WebDAV is SFCC’s “remote filesystem over HTTP”. It’s central to:
This skill focuses on practical workflows and the most common permission and path pitfalls.
[ ] Confirm which auth path you are using: BM user (Basic Auth) vs API client (client-id/secret token)
[ ] For IMPEX, ensure the BM role includes File Transfer Manager access
[ ] If using API client auth, generate credentials in Account Manager
[ ] Verify directory permissions are configured in Business Manager for the exact folder(s)
[ ] Avoid overlapping WebDAV client permission paths (SFCC restriction)
[ ] Don’t expect write access to restricted folders (e.g. security logs)
[ ] For automation: scope access to the minimum folders required/catalogs/* or “all other folders”) grant access to future subfolders automaticallyThese vary by project, but the patterns are stable:
| Folder | Typical use | Read/Write? |
|---|---|---|
/impex/src/ | Upload import feeds, export results | Usually read/write |
/impex/src/logs/ | Some log exports and job artifacts | Often read |
/Logs/ | Log files (application logs) | Usually read |
/catalogs/ | Catalog assets (shared library content, images) | Often read |
/cartridges/ | Code deployment via WebDAV (teams vary) | Usually read/write for deployment users |
WebDAV_Realm_Access, WebDAV_Manage_Customization, WebDAV_Transfer_Files./catalogs/* or “all other folders”), permissions apply to future subfolders automatically unless sub-permissions are set explicitly.client_id → permissions array of { path, operations }.Operations typically include: read, read_write.
SFCC does not allow different WebDAV client permission paths to overlap.
Example of what to avoid:
/impex/src/impex/src/fooDesign your permission model so each client owns a non-overlapping subtree.
Some directories are effectively read-only for security reasons (for example, security log directories). Expect permission errors even if you attempt to grant write.
Create separate API clients for:
/Logs/)/impex/src/)This keeps credentials and blast radius smaller.
When storefront requests can’t write files, a common SFCC pattern is:
/impex/src/ (or another allowed folder)(See also: sfcc-platform-limits for storefront file I/O constraints.)
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.