chargebee-integration
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for initializing project configurations using the
npx chargebee-initcommand. This utilizes a CLI tool published by the vendor to automate setup for specific frameworks. - [EXTERNAL_DOWNLOADS]: The skill references official SDK repositories on GitHub belonging to the vendor (e.g.,
github.com/chargebee/chargebee-python) and links to the vendor's primary documentation domain (apidocs.chargebee.com). These resources are used to retrieve implementation guides and API specifications. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for ingesting and processing webhook event data from the Chargebee platform.
- Ingestion points: The
handle_webhookfunction inSKILL.mdandreferences/webhooks.mdprocesses JSON payloads received from external HTTP POST requests. - Boundary markers: The instructions mandate validating the authenticity of these requests using Basic Authentication credentials.
- Capability inventory: The skill enables the agent to interact with billing data through REST API calls and SDK methods, including retrieving and updating customer and subscription records.
- Sanitization: While the skill demonstrates basic credential validation, it does not specify detailed input sanitization for the data contained within the webhook payloads.
Audit Metadata