woocommerce
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill follows best practices for secret management by using environment variables (MATON_API_KEY) and communicates exclusively with the vendor's documented domains (maton.ai).
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external WooCommerce stores (including product descriptions, customer details, and reviews). This represents a standard vulnerability surface where an attacker controlling store content could attempt to influence agent behavior through embedded instructions.
- Ingestion points: WooCommerce API JSON responses (SKILL.md)
- Boundary markers: None provided in example code
- Capability inventory: Network operations (SKILL.md)
- Sanitization: None implemented in the provided documentation snippets
Audit Metadata