tax-compliance-automation
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate instructions and code snippets for tax compliance automation using industry-standard tools and official APIs.
- [DATA_EXFILTRATION]: The code snippets include a network request to ec.europa.eu to validate EU VAT numbers. This targets an official, well-known service of the European Commission and is consistent with the skill's primary purpose.
- [CREDENTIALS_UNSAFE]: The implementation examples correctly demonstrate using environment variables (process.env.TAXJAR_API_KEY) for secret management rather than hardcoding API keys.
- [INDIRECT_PROMPT_INJECTION]: The skill defines functions that process untrusted data (customer addresses, order items). 1. Ingestion points: calculateTaxForOrder and commitTaxTransaction in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: SDK API calls and fetch. 4. Sanitization: Absent. This represents a standard input processing surface for a tax calculation skill with no malicious patterns detected.
Audit Metadata