marketplace-connectors
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides educational content and code snippets for marketplace integrations using well-known, official APIs from Amazon, eBay, and Walmart. The implementation correctly handles secrets using environment variables.
- [EXTERNAL_DOWNLOADS]: The skill references standard, industry-recognized libraries such as @smithy/signature-v4 and @aws-crypto/sha256-js for implementing AWS Signature V4 authentication.
- [COMMAND_EXECUTION]: No dangerous shell commands or privileged operations are included in the instructions or code examples.
- [INDIRECT_PROMPT_INJECTION]: The skill describes logic to ingest marketplace data. -- Ingestion points: The pollAmazonOrders function in SKILL.md fetches order data from the Amazon SP-API. -- Boundary markers: No specific delimiters or ignore embedded instructions warnings are present. -- Capability inventory: The logic enqueues data for processing; no immediate dangerous capabilities like eval, subprocess, or file system writes are executed on the ingested data. -- Sanitization: The data is mapped to structured internal order fields rather than being passed to an LLM prompt.
Audit Metadata