commerce-evals
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Testing Surface: The skill identifies a potential attack surface by providing guidelines for testing agents against 'poisoned fixtures.' These fixtures simulate untrusted external data, such as product listings or reviews, that might contain malicious instructions. This is a proactive security testing practice designed to verify that agents correctly ignore or refuse instructions embedded in third-party data.\n
- Ingestion points: Evaluation fixtures representing external commerce data (listings, reviews, messages) in SKILL.md.\n
- Boundary markers: The framework uses specific negative expectations (e.g.,
never_calls,reply_omits) to verify that the agent ignores instructions embedded in data, rather than defining input-level delimiters.\n - Capability inventory: The agents under evaluation are expected to have capabilities for managing carts, staging transaction changes, and updating persistent memory, which are the targets of the described testing scenarios.\n
- Sanitization: The guidelines focus on end-to-end behavioral verification (ensuring the agent does not follow instructions in data) rather than implementing specific sanitization routines within the evaluation skill itself.
Audit Metadata