emap-merchant-signup
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The build verification system uses a gate script (
verify/scripts/emap_gate.py) that invokes a local Python script (verify_form.py) viasubprocess.run. This is a standard and safe implementation of local developer tooling for schema validation. - [EXTERNAL_DOWNLOADS]: The form templates fetch the
intl-tel-inputlibrary fromcdn.jsdelivr.net. These references are properly secured using Subresource Integrity (SRI) hashes andcrossoriginattributes to ensure only untampered versions of the library are executed. - [DYNAMIC_EXECUTION]: React component templates (
SignupForm.tsx) programmatically inject their own logic into the DOM via a<script>tag. The script content is derived from a hardcoded constant within the same file, which is a common pattern for mounting imperative logic in component-based frameworks.
Audit Metadata