mercadopago
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses Ruby's standard library (net/http, json, fileutils) and has zero external dependencies, minimizing the supply chain risk.
- [CREDENTIALS_UNSAFE]: While the skill manages an API token, it implements secure storage practices by saving the token to ~/.config/mercadopago/token and using File.chmod(0600) to restrict access to the current user only. The instructions also explicitly guide the user to obtain this token from the official MercadoPago developer panel.
- [EXTERNAL_DOWNLOADS]: All network operations are directed to the official api.mercadopago.com domain. There are no requests to unverified or suspicious third-party servers.
- [COMMAND_EXECUTION]: The skill uses standard shell commands to run its internal Ruby scripts. The instructions include safety checkpoints, requiring the AI to obtain explicit user confirmation before executing write operations such as create_payment.rb or refund.rb.
Audit Metadata