fianto
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external data sources, such as webhook payloads and order metadata, which serves as an ingestion point for untrusted content. The documentation in references/security.md provides strong boundary markers, instructing the agent to treat this content as data rather than instructions and to report any detected injection attempts to the user. It also specifies sanitization practices, such as escaping text and avoiding unsafe interpolation. The capability inventory includes payment and subscription management via the vendor's SDK and CLI.
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation and technical references from the vendor's official domain at docs.fianto.xyz to maintain an accurate source of truth.
- [COMMAND_EXECUTION]: The skill utilizes the vendor's CLI tool, @fianto/cli, to perform verification and testing tasks such as checking application status or triggering sample webhook events.
Audit Metadata