commerce-trust-safety
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection Surface]: The skill describes handling data from external, untrusted sources such as web content and reviews, which is a common vector for indirect prompt injection.\n
- Ingestion Points: Data flows from catalog, reviews, and web search results into the agent context (SKILL.md).\n
- Boundary Markers: The architecture utilizes role-specific labels to wrap untrusted content, helping the model distinguish between instructions and data (SKILL.md).\n
- Capability Inventory: The system includes tools for writing to carts and staging merchant changes (SKILL.md).\n
- Sanitization: Implementation of NFKC normalization and removal of hidden characters serves as a defensive layer against adversarial prompts (SKILL.md).\n- [Provenance-Gated Writes]: The skill enforces that write operations can only be performed on items that have a verified provenance within the current session, reducing the risk of unauthorized data manipulation.\n- [Secure Identity Handling]: Identity management is abstracted to the server level using unguessable session IDs, ensuring that sensitive user or merchant identifiers are not passed through potentially exploitable tool arguments.
Audit Metadata