shipment-tracking
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructions for shipment tracking integrations that follow established security best practices.
- [INDIRECT_PROMPT_INJECTION]: The skill describes an ingestion surface for external carrier webhooks (e.g., EasyPost). 1. Ingestion points: Webhook receiver logic in SKILL.md and associated evaluation tasks. 2. Boundary markers: The implementation includes HMAC signature verification to ensure data authenticity. 3. Capability inventory: The skill updates internal database records and triggers customer email notifications based on received events. 4. Sanitization: External status codes are normalized through a predefined static mapping before being processed by the system.
- [CREDENTIALS_UNSAFE]: Code examples correctly demonstrate the use of environment variables (process.env.EASYPOST_API_KEY) for secret management rather than hardcoding sensitive credentials.
Audit Metadata