mena-commerce-pos-accounting
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes external vendor documentation to provide integration guidance, which is a potential surface for indirect prompt injection. This risk is effectively mitigated by specific instructions in
SKILL.mdthat require human approval for high-risk live actions and the use of explicit 'unknown' labels for unverified data. - Ingestion points: Official documentation URLs for vendors like Salla, Zid, and Foodics.
- Boundary markers: Includes a 'Response Contract' and validation checklist to prevent the agent from acting autonomously on high-risk workflows.
- Capability inventory: The skill is scoped to analysis, planning, and documentation mapping.
- Sanitization: Instructions prioritize source-backed facts and mandatory human approval gates.
- [COMMAND_EXECUTION]: The skill includes a helper script
scripts/list-vendors.mjsused for deterministic vendor identification. The script reads a data file (../../../data/processed/vendors.json) located within the project's data directory. This file access is part of the vendor's intended architecture for managing regional vendor data.
Audit Metadata