order-fulfillment-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting untrusted data from external e-commerce platforms (Shopify, WooCommerce, BigCommerce) and user-supplied parameters. This data represents a potential vector for indirect prompt injection, where malicious instructions hidden within customer names, product descriptions, or shipping addresses could attempt to influence the agent's behavior during fulfillment processing.
- Ingestion points: External order data and customer parameters are retrieved from platform APIs and processed in
SKILL.mdand referenced in the task context for custom fulfillment modules (e.g.,evals/fulfillment-state-machine-and-barcode-sc/task.md). - Boundary markers: The implementation logic does not explicitly define delimiters or provide specific instructions to the agent to ignore instructions embedded within the data payloads.
- Capability inventory: The fulfillment workflow utilizes network capabilities via the Shippo API for carrier label creation and file system operations for generating PDF packing slips as specified in the evaluation criteria.
- Sanitization: No data validation or sanitization patterns are provided to escape or filter potentially malicious content from the processed order fields.
Audit Metadata