commerce-trust-safety
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- Secure Content Fencing: The skill implements a sanitization layer for third-party data (reviews, web content, catalog results). It utilizes NFKC-normalization and the removal of control characters to mitigate risks associated with untrusted content.
- Write-Gating and Provenance Verification: It enforces strict rules for commerce operations, such as requiring that cart updates only reference products already verified in the session's catalog reads. This ensures that the agent cannot be manipulated into acting on unverified or malicious identifiers.
- Identity Protection: The skill specifies that authenticated identity is managed server-side using session IDs, ensuring that no sensitive user or merchant identifiers are passed through tool arguments or request fields.
- Resource and Memory Constraints: It defines limits for search results, cart lines, and memory persistence. Memory extraction is filtered to prevent the storage of sensitive identifier patterns, and data is subject to defined retention policies.
Audit Metadata