tax-calculation
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted user input from checkout forms, including shipping addresses and buyer VAT registration numbers. These inputs are used in network calls to the official EU VIES API and third-party tax calculation providers. 1. Ingestion points: 'toAddress' and 'buyerVatNumber' parameters in the VAT calculation logic in vatCalculation.js. 2. Capability inventory: Use of 'fetch' for network requests and third-party API clients. 3. Boundary markers: Not explicitly implemented in the sample code. 4. Sanitization: Input validation for the VAT number string is not shown before it is appended to the API request URL.
- [EXTERNAL_DOWNLOADS]: The skill relies on external services and libraries for its primary functionality. It makes requests to the European Commission's official VIES REST API (ec.europa.eu) for business verification. Additionally, the evaluation tasks mandate the use of the 'taxjar' and 'avatax' Node.js packages, which are official and well-known libraries for tax compliance.
Audit Metadata