paypal-integration
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to load the PayPal JavaScript SDK from the official PayPal CDN (https://www.paypal.com/sdk/js). This is the standard and recommended method for integrating PayPal buttons.
- [COMMAND_EXECUTION]: The documentation references various platform-specific setup steps and CLI tools (e.g., Shopify, WooCommerce, BigCommerce), but does not execute arbitrary or dangerous shell commands.
- [INDIRECT_PROMPT_INJECTION]: The skill implements endpoints that process external data such as 'cartId' and 'orderId' which are then used in network requests and database operations. This is a standard requirement for payment integrations but represents a potential ingestion surface for untrusted data.
- Ingestion points: 'req.body.cartId' and 'req.body.orderId' in the Node.js snippets within SKILL.md.
- Boundary markers: None present in the simplified code examples provided.
- Capability inventory: Uses 'fetch' for outbound network calls to PayPal's API and performs mock database lookups.
- Sanitization: No explicit sanitization or validation is shown in the instructional snippets, though the context is restricted to payment identifiers.
Audit Metadata