financial-audit-trail
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate instructions and code templates for implementing financial compliance logging. It emphasizes security best practices including tamper-detection through hash chaining and the enforcement of append-only logic using database-level GRANT/REVOKE permissions.
- [INDIRECT_PROMPT_INJECTION]: The skill describes methods for ingesting data from external e-commerce APIs (Shopify, BigCommerce, WooCommerce). While this constitutes a vulnerability surface where malicious external data could be logged, the skill focuses on data persistence for auditing rather than using the ingested data to influence agent behavior.
- Ingestion points: Data is fetched from Shopify Admin API, BigCommerce Orders API, and WooCommerce plugins as detailed in the platform instructions in SKILL.md.
- Boundary markers: Not explicitly defined in the provided code templates.
- Capability inventory: The skill involves database insertion (INSERT) and network read access to official e-commerce service endpoints.
- Sanitization: The provided TypeScript code uses standard JSON serialization for storing state snapshots without explicit sanitization or filtering of fields.
Audit Metadata