bitrix-sale
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a documentation repository for the Bitrix24 sale module API. It provides code examples and architectural rules for managing baskets, orders, payments, and shipments.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies surfaces for untrusted data ingestion, such as AJAX controllers and POST data processing (
setValuesFromPostinrules/order.md). It addresses these risks by mandating security best practices, including explicit CSRF token verification (sessid) and granular permission checks (CSaleOrder::CanUserViewOrder) before any action is taken on user-supplied data. - [COMMAND_EXECUTION]: While the skill mentions dynamic loading of module components (e.g.,
PaySystem\Manager::includeHandler), these are standard operations within the Bitrix framework and do not involve arbitrary command execution or untrusted user input.
Audit Metadata